diff --git a/lib/hx509/keyset.c b/lib/hx509/keyset.c
index 15327cb8d..79a9beb0c 100644
--- a/lib/hx509/keyset.c
+++ b/lib/hx509/keyset.c
@@ -225,6 +225,12 @@ hx509_ci_print_names(hx509_context context, void *ctx, hx509_cert c)
     return 0;
 }
 
+/*
+ * The receiving keyset `certsī will either increase reference counter
+ * of the `certī or make a deep copy, either way, the caller needs to
+ * free the `certī itself.
+ */
+
 int
 hx509_certs_add(hx509_context context, hx509_certs certs, hx509_cert cert)
 {