yes it needs more docs - currently there is a note in the predocs repo about how it works. The first implementation only has clientsert as a key. There is also a key called "authenticated" which is set to "remote", "local" or false indicating if this was a remote (certificate validated) request, a local request (i.e. puppet apply, or internal runs like rspec testing), or false (remote and not authenticated). In a way, this key is like "authority" (the method used to assert that the values in trusted are just that. Maybe it is too simplistic going forward...