diff --git a/xep-0363.xml b/xep-0363.xml
index c3a165f0..f4e48919 100644
--- a/xep-0363.xml
+++ b/xep-0363.xml
@@ -354,6 +354,7 @@ Content-Security-Policy: default-src 'none'; frame-ancestors 'none';
 ]]></code>
   <p>The provided policy will prohibit a browser from executing all active content from the HTTP upload domain (<em>default-src 'none'</em>) and forbid embedding it from other pages (<em>frame-ancestors 'none'</em>). More information on Content-Security-Policy can be found on <link url="https://infosec.mozilla.org/guidelines/web_security#content-security-policy">infosec.mozilla.org</link>.</p>
   <p>Further isolation can be achieved by hosting those files on an entirely different domain instead of using subdomains.</p>
+  <p>Headers may be signed so that receiving HTTP entities can verify these haven't been tempered with by clients.</p>
   </section2>
   <section2 topic="Uploader" anchor="uploader">
     <ul>