diff --git a/README.md b/README.md
index 8abef2d..3641f13 100644
--- a/README.md
+++ b/README.md
@@ -104,6 +104,7 @@ it the backup stops with a permission error on a protected directory.
 # Check that a snapshot's blobs are all present, with the listed sizes.
 vaultik snapshot verify <snapshot-id>
 
+# Run the next three commands on a machine that holds the private key.
 # Put the private key in the environment. Reading it from the file keeps it
 # out of your shell history.
 export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
@@ -881,8 +882,8 @@ export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
 ```
 
 Do not put the private key on a machine you back up. Anyone who breaks into that
-machine could then decrypt its backups. Supply the key only on the machine you
-restore on.
+machine could then decrypt its backups. Supply the key only on the machine where
+you run `snapshot restore` or `snapshot verify --deep`.
 
 ### Exclude patterns
 
diff --git a/config.example.yml b/config.example.yml
index d78982b..800fff7 100644
--- a/config.example.yml
+++ b/config.example.yml
@@ -17,8 +17,8 @@ age_recipients:
 # Age private key for decryption
 # Only snapshot restore and snapshot verify --deep need it. The
 # VAULTIK_AGE_SECRET_KEY environment variable overrides this setting
-# Do not set it on a machine you back up: prefer the environment variable,
-# supplied only on the machine you restore on
+# Do not set it on a machine you back up. Supply the environment variable
+# only on a machine where you run snapshot restore or snapshot verify --deep
 # Default: not set
 #age_secret_key: YOUR_AGE_PRIVATE_KEY