diff --git a/kdc/pkinit.c b/kdc/pkinit.c
index 1d7207237..bb19cadef 100644
--- a/kdc/pkinit.c
+++ b/kdc/pkinit.c
@@ -775,6 +775,7 @@ pk_mk_pa_reply_enckey(krb5_context context,
 					NULL,
 					cert,
 					client_params->peer,
+					/* XXX should be the clients anchors */
 					kdc_identity->anchors,
 					kdc_identity->certpool,
 					&signed_data);
@@ -888,6 +889,7 @@ pk_mk_pa_reply_dh(krb5_context context,
 					NULL,
 					cert,
 					client_params->peer,
+					/* XXX should be the clients anchors */
 					kdc_identity->anchors,
 					kdc_identity->certpool,
 					&signed_data);