diff --git a/configs/config.example.yml b/configs/config.example.yml
index 4186342..563d10c 100644
--- a/configs/config.example.yml
+++ b/configs/config.example.yml
@@ -375,3 +375,9 @@ compression_level: 5
 # Hostname to use in backup metadata
 # Default: system hostname
 #hostname: myserver
+
+# Environment variables that vaultik sets in its own process when it loads
+# the config. Its keys are variable names
+# Default: none
+#env:
+#  NAME: value
diff --git a/docs/REPOSTRUCTURE.md b/docs/REPOSTRUCTURE.md
index 1839e2c..b530143 100644
--- a/docs/REPOSTRUCTURE.md
+++ b/docs/REPOSTRUCTURE.md
@@ -12,6 +12,8 @@ is a storage service set up in rclone. The layout is the same on all three.
 - **Snapshot**: one backup of the paths listed under one name in the config.
 - **Snapshot ID**: the name of a snapshot, in the form
   `<hostname>_<snapshot-name>_<timestamp>`.
+- **Remote key**: a hash of the snapshot ID. It names the snapshot's directory
+  under `metadata/`. See [Remote keys](#remote-keys).
 - **Chunk**: a piece of a file's content, named by the SHA-256 hash of that
   content.
 - **Blob**: one object under `blobs/`. It holds many chunks.
diff --git a/internal/cli/snapshot_restore.go b/internal/cli/snapshot_restore.go
index 91a613c..de1488c 100644
--- a/internal/cli/snapshot_restore.go
+++ b/internal/cli/snapshot_restore.go
@@ -48,10 +48,10 @@ typing it, so that it does not land in your shell history:
 
   export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
 
-Also needs permission to read the backup destination store (and to list
+Also needs permission to read the backup destination store, and to list
 it when given a remote key, or a snapshot ID that is not in the local
-index), and free space in the temporary directory for the decrypted
-blobs.
+index. It also needs free space in the temporary directory for the
+decrypted blobs.
 
 Examples:
   # Restore entire snapshot