diff --git a/peer/cwtchprofilestorage.go b/peer/cwtchprofilestorage.go
index 8d12571..d859c67 100644
--- a/peer/cwtchprofilestorage.go
+++ b/peer/cwtchprofilestorage.go
@@ -763,6 +763,9 @@ func (cps *CwtchProfileStorage) Delete() {
 	}
 }
 
+// Rekey re-encrypts the datastore with the new key.
+// **note* this is technically a very dangerous API and should only be called after
+// checks on the current password and the derived new password.
 func (cps *CwtchProfileStorage) Rekey(newkey [32]byte) error {
 	// PRAGMA queries don't allow subs...
 	_, err := cps.db.Exec(fmt.Sprintf(`PRAGMA rekey="x'%x'";`, newkey))