add comment about not signing the keys