small comment about ssh config

nixos/modules/deployment.nix

@@ -8,6 +8,9 @@ let
   # execute a certain command *only*.
   restrictedKey =
     { authorizedKey, command, gridName }:
+    # `restrict` means "disable all the things" then `command` means "but
+    # enable running this one command" (the client does not have to supply the
+    # command; if they authenticate, this is the command that will run).
     "restrict,command=\"${command} ${gridName}\" ${authorizedKey}";
 in {
   options = {