diff --git a/authority/provisioner/jwk.go b/authority/provisioner/jwk.go
index f6ed9bbf..05c079d7 100644
--- a/authority/provisioner/jwk.go
+++ b/authority/provisioner/jwk.go
@@ -195,6 +195,7 @@ func (p *JWK) AuthorizeSSHSign(ctx context.Context, token string) ([]SignOption,
 
 	t := now()
 	// Add modifiers from custom claims
+	// FIXME: this is also set in the sign method using SSHOptions.Modify.
 	if opts.CertType != "" {
 		signOptions = append(signOptions, sshCertificateCertTypeModifier(opts.CertType))
 	}