@@ -58,13 +58,20 @@ The repo contents are streamed into `STDIN` as an uncompressed archive (tar file
 
 #### Create a user by uploading a public key from your laptop
 
-We just pipe it into the `gitreceive upload-key` command via SSH:
+We just pipe our local SSH key into the `gitreceive upload-key` command via SSH:
 
     $ cat ~/.ssh/id_rsa.pub | ssh you@yourserver.com "sudo gitreceive upload-key <username>"
 
 The `username` argument is just an arbitrary name associated with the key, mostly
 for use in your system for auth, etc.
 
+`gitreceive upload-key` will authorize this key for use on the `$GITUSER`
+account on the server, and use the SSH "forced commands" syntax in the remote
+`.ssh/authorized_keys` file,  causing the internal `gitreceive run` command to
+be called when this key is used with the remote git account. This allows us to
+intercept the `git` requests and set up a `pre-receive` hook to run on the
+repo, which triggers the custom receiver script.
+
 #### Add a remote to a local repository
 
     $ git remote add demo git@yourserver.com:example.git
 
@@ -29,10 +29,11 @@ EOF
     echo "Created receiver script in $GITHOME for user '$GITUSER'."
     ;;
 
-  upload-key) # gitreceive upload-key <username>
+  upload-key) # sudo gitreceive upload-key <username>
     KEY=$(cat)
     FINGERPRINT=$(ssh-keygen -lf /dev/stdin <<< $(echo $KEY) | awk '{print $2}')
     AUTHORIZED_KEYS=$GITHOME/.ssh/authorized_keys
+    # When this key is used, use the ssh 'forced command' feature to have 'gitreceive run' to run instead.
     KEY_PREFIX="command=\"$SELF run $2 $FINGERPRINT\",no-agent-forwarding,no-pty,no-user-rc,no-X11-forwarding,no-port-forwarding"
     echo "$KEY_PREFIX $KEY" >> $AUTHORIZED_KEYS
     echo $FINGERPRINT
@@ -42,6 +43,7 @@ EOF
   run) 
     export RECEIVE_USER=$2
     export RECEIVE_FINGERPRINT=$3
+    # ssh provides the original requested command in $SSH_ORIGINAL_COMMAND
     eval $(echo $SSH_ORIGINAL_COMMAND | awk '{print "export RECEIVE_REPO="$2}')
     REPO_PATH="$GITHOME/$RECEIVE_REPO"
     if [ ! -d $REPO_PATH ]; then