chore(docs): Add section for retrievable vs irretrievable keys

docs/pages/design/node/index.md

@@ -98,4 +98,12 @@ The `Auth` object should contain an identifier for the non-user principal making
 
 #### Security considerations
 
-The hashed key should be returned in the response for better security. When attempting to verify the API Key, then the `key` argument provided should be hashed and compared to the stored hashed key. If they match, then the API Key is valid.
+API-key implementations is divided into two groups: **Retrievable** and **Irretrievable**. Each have their security tradeoffs.
+
+**Irretrievable:**
+
+The keys are stored via a one-way encryption process so they can never be retrieved, or stolen from the database in a worse case scenario. Stripe and Amazon AWS use this approach.
+
+It's recommended to store keys as sha256 hashes and set primary keys to minimize hash collisions, also having retry logic on creation and insertion.
+
+[Unkey](https://unkey.dev/docs/security/overview) applies a similar concept, where the hashed keys get stored. When attempting to verify the API Key, then the `key` argument gets hashed and compared to the stored hashed key. If they match, then the API Key is valid.