note to self

src/_zkapauthorizer/controller.py

@@ -222,6 +222,8 @@ class RistrettoRedeemer(object):
         ))
 
     def tokens_to_passes(self, message, unblinded_tokens):
+        # XXX Here's some more of the privacypass dance.  Something needs to
+        # know to call this, I guess?  Also it's untested as heck.
         clients_preimages = list(
             token.preimage()
             for token