diff --git a/tools/release/make-release-key.sh b/tools/release/make-release-key.sh
index 680fcab91..1278ff800 100755
--- a/tools/release/make-release-key.sh
+++ b/tools/release/make-release-key.sh
@@ -1,15 +1,4 @@
 #!/usr/bin/env bash
-# make-release-key.sh - run ONCE, by the owner. Makes DroidDeck's signing key and gives it to GitHub.
-#
-#   - The key is made on this device, in ~/droiddeck-release-key (outside the repo), with a long
-#     random password written beside it. Nothing secret is printed.
-#   - The key and password are secrets in the signing-main and release environments.
-#     PR build jobs use only the public test key.
-#   - The key's certificate digest - public, not a secret - goes to keystore/release-signer.sha256,
-#     which CI checks every signed apk against. That file is the only thing to commit.
-#
-# BACK UP ~/droiddeck-release-key (both files) somewhere safe - a password manager, a USB stick.
-# Without it no update can ever be signed for the people who installed a signed build.
 set -euo pipefail
 
 REPO=Droid-Deck/DroidDeck
@@ -32,7 +21,6 @@ done
 umask 077
 mkdir -p "$OUT"
 KS="$OUT/droiddeck-release.p12"
-# 48 random characters; PKCS12 uses one password for the store and the key.
 KS_PW=$(head -c 60 /dev/urandom | base64 -w0 | tr -d '/+=')
 KS_PW=${KS_PW:0:48}
 [ ${#KS_PW} -ge 40 ] || die "could not make a password"