1 files changed, 10 insertions, 2 deletions

diff --git a/doc/guix.texi b/doc/guix.texi
index c5fed97da08..e7f1826542d 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -5674,7 +5674,11 @@ references, corresponding derivation, and a digital signature.
 When exporting, the daemon digitally signs the contents of the archive,
 and that digital signature is appended.  When importing, the daemon
 verifies the signature and rejects the import in case of an invalid
-signature or if the signing key is not authorized.
+signature or if the signing key is not authorized; as an exception,
+store items that are @dfn{content-addressed}---source files and
+@file{.drv} files (@pxref{Derivations})---can be imported even if they
+lack an authorized signature because adding these to the store is not
+creating any new risk.
 @c FIXME: Add xref to daemon doc about signatures.
 
 The main options are:
@@ -5724,6 +5728,7 @@ Alternatively, @var{parameters} can specify
 public-key related Functions, @code{gcry_pk_genkey},, gcrypt, The
 Libgcrypt Reference Manual}).
 
+@anchor{archive-authorization}
 @item --authorize
 @cindex authorizing, archives
 Authorize imports signed by the public key passed on standard input.
@@ -51032,12 +51037,15 @@ with an @code{environment} of @code{managed-host-environment-type}.
 @item @code{host-name}
 @item @code{build-locally?} (default: @code{#t})
 If false, system derivations will be built on the machine being deployed to.
+As a bonus, when false, one does not need the target machine to have the
+key of the deployment machine among its authorized keys and thus the
+@code{authorize?} field below can remain @code{#f}.
 @item @code{system}
 The system type describing the architecture of the machine being deployed
 to---e.g., @code{"x86_64-linux"}.
 @item @code{authorize?} (default: @code{#t})
 If true, the coordinator's signing key will be added to the remote's ACL
-keyring.
+keyring (@pxref{archive-authorization, authorizing imports}).
 @item @code{port} (default: @code{22})
 @item @code{user} (default: @code{"root"})
 @item @code{identity} (default: @code{#f})