diff --git a/group_vars/all/root_access.yml b/group_vars/all/root_access.yml
index 8950da7b..4f91df46 100644
--- a/group_vars/all/root_access.yml
+++ b/group_vars/all/root_access.yml
@@ -26,6 +26,7 @@ root_ssh_keys:
   - anthraxx.pub
 
 # run playbook 'playbooks/tasks/reencrypt-vault-key.yml' when this changes
+# before running it, make sure to gpg --lsign-key all of the below keys
 root_gpgkeys:
   - CFA6AF15E5C74149FC1D8C086D1655C14CE1C13E # bluewind
   - F3691687D867B81B51CE07D9BBE43771487328A9 # bpiotrowski