diff --git a/SECURITY.md b/SECURITY.md
index eeb0a03..dfd039c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -15,6 +15,8 @@ SSH signing is preferred over PGP signing.
 
 To enable signature verification, add your public key to your Tangled profile, and optionally the `.allowed_signers` file in the project's repo.
 
+Tangled profiles should be trusted over the repo's copy, excluding revoked keys.
+
 ## Setup
 Replace `<YOUR_KEY>` with the SSH key or keyfile you'd like to use (eg. `~/.ssh/id_ed25519`).