[DOCS] open_mode better docs and examples

Description of Issue/Question

I have a lab setup, with salt-master and multiple minions. To avoid having to preseed keys and manually accept keys, i use open_mode and auto_accept. However, if I rebuilt the salt-master, and a new master key gets generated. At that point the existing minions can no longer connect, until I remove /etc/salt/pki/minion/minion_master.pub on each minion. My understanding from the docs is that if i set open_mode: True in the minion config, it will do that for me. However, i run into the issue below:

Setup

1. salt-master

auto_accept: True
open_mode: True

2. salt-minion config

open_mode: True
master_tries: -1
auth_tries: -1
ping_interval: 5
rejected_retry: True
acceptance_wait_time: 5
acceptance_wait_time_max: 5
auth_timeout: 5
random_reauth_delay: 2

Steps to Reproduce Issue

root@master:~# salt ubuntu16.local test.version
ubuntu16.local:
    2017.7.8
root@master:~# salt ubuntu16.local test.ping
ubuntu16.local:
    True
root@master:~# rm -rf /etc/salt/pki/master/*
root@master:~# systemctl restart salt-master
------ wait a bit -----
root@master:~# salt-key
Accepted Keys:
ubuntu16.local
Denied Keys:
Unaccepted Keys:
Rejected Keys:
root@master:~# salt ubuntu16.local test.ping
ubuntu16.local:
    Minion did not return. [No response]

Then on the minion. I expect with open_minion: True that the minion will just work. Instead I get:

root@ubuntu16:~# salt-call test.ping
[ERROR   ] Exception in callback <functools.partial object at 0x7f28464967e0>
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/tornado/ioloop.py", line 592, in _run_callback
    ret = callback()
  File "/usr/lib/python2.7/dist-packages/tornado/stack_context.py", line 275, in null_wrapper
    return fn(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/tornado/ioloop.py", line 598, in <lambda>
    self.add_future(ret, lambda f: f.result())
  File "/usr/lib/python2.7/dist-packages/tornado/concurrent.py", line 215, in result
    raise_exc_info(self._exc_info)
  File "/usr/lib/python2.7/dist-packages/tornado/gen.py", line 876, in run
    yielded = self.gen.throw(*exc_info)
  File "/usr/lib/python2.7/dist-packages/salt/crypt.py", line 514, in _authenticate
    creds = yield self.sign_in(channel=channel)
  File "/usr/lib/python2.7/dist-packages/tornado/gen.py", line 870, in run
    value = future.result()
  File "/usr/lib/python2.7/dist-packages/tornado/concurrent.py", line 215, in result
    raise_exc_info(self._exc_info)
  File "/usr/lib/python2.7/dist-packages/tornado/gen.py", line 879, in run
    yielded = self.gen.send(value)
  File "/usr/lib/python2.7/dist-packages/salt/crypt.py", line 651, in sign_in
    auth['aes'] = self.verify_master(payload, master_pub='token' in sign_in_payload)
  File "/usr/lib/python2.7/dist-packages/salt/crypt.py", line 992, in verify_master
    return self.extract_aes(payload, master_pub=False)
  File "/usr/lib/python2.7/dist-packages/salt/crypt.py", line 917, in extract_aes
    aes, token = self.decrypt_aes(payload, master_pub)
  File "/usr/lib/python2.7/dist-packages/salt/crypt.py", line 780, in decrypt_aes
    m_digest = public_decrypt(mkey.publickey(), payload['sig'])
  File "/usr/lib/python2.7/dist-packages/salt/crypt.py", line 243, in public_decrypt
    return verifier.verify(message)
  File "/usr/lib/python2.7/dist-packages/salt/utils/rsax931.py", line 162, in verify
    raise ValueError('Unable to decrypt message')
ValueError: Unable to decrypt message

With open_mode: False, which is the default, there is a message to remove the master key manually.

root@ubuntu16:~# sed -i '/open_mode/d' /etc/salt/minion
root@ubuntu16:~# salt-call test.ping
[ERROR   ] The master key has changed, the salt master could have been subverted, verify salt master's public key
[CRITICAL] The Salt Master server's public key did not authenticate!
The master may need to be updated if it is a version of Salt lower than 2017.7.8, or
If you are confident that you are connecting to a valid Salt Master, then remove the master public key and restart the Salt Minion.
The master public key can be found at:
/etc/salt/pki/minion/minion_master.pub

Versions Report

root@master:~# salt --versions-report
Salt Version:
           Salt: 2017.7.8

Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.4.2
      docker-py: Not Installed
          gitdb: 0.6.4
      gitpython: 1.0.1
          ioflo: Not Installed
         Jinja2: 2.8
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: 1.0.3
   msgpack-pure: Not Installed
 msgpack-python: 0.4.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 2.7.12 (default, Dec  4 2017, 14:50:18)
   python-gnupg: Not Installed
         PyYAML: 3.11
          PyZMQ: 15.2.0
           RAET: Not Installed
          smmap: 0.9.0
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.1.4

System Versions:
           dist: Ubuntu 16.04 xenial
         locale: UTF-8
        machine: x86_64
        release: 4.4.0-116-generic
         system: Linux
        version: Ubuntu 16.04 xenial

Start by reviewing the existing open_mode and auto_accept configuration documentation, then trace the authentication path in salt/crypt.py and the verification error in salt/utils/rsax931.py. Document the expected behavior after a master key changes, including the minion_master.pub case, and add examples that distinguish open_mode from the manual recovery path.