diff --git a/src/Tahoe/CHK/Cipher.hs b/src/Tahoe/CHK/Cipher.hs
index 43a45ef7b44bbf6b838ce3b03c99dc8cd249cf58..953c6fa18a79c1115054f81dfc01582d9cfaa0ee 100644
--- a/src/Tahoe/CHK/Cipher.hs
+++ b/src/Tahoe/CHK/Cipher.hs
@@ -16,6 +16,13 @@ import qualified Data.ByteArray as BA
 import Data.Coerce (coerce)
 import GHC.Generics (Generic)
 
+{- | A block cipher key which can be deserialized from or serialized to a
+ ByteArray.
+
+ This is a wrapper around Crypto.Cipher.Types.Cipher which does not provide a
+ way to recover the original bytes of the key.  We provide this by keeping the
+ original bytes around.
+-}
 data Key cipher = Key {keyBytes :: ScrubbedBytes, keyCipher :: cipher}
 
 deriving instance Generic (Key cipher)