diff --git a/crates/punktfunk-host/src/identity.rs b/crates/punktfunk-host/src/identity.rs
index 8cd869ae..aa8129be 100644
--- a/crates/punktfunk-host/src/identity.rs
+++ b/crates/punktfunk-host/src/identity.rs
@@ -3,12 +3,12 @@
 //! History: ONE RSA-2048 identity (`gamestream::cert`) served every plane, because Moonlight
 //! mandates RSA and the planes grew out of the GameStream host. The native punktfunk/1 QUIC
 //! plane and the management API now share THIS identity instead: **ECDSA P-256** — generated by
-//! ring via rcgen (no `rsa` crate on the native path, so the accepted Marvin advisory
-//! RUSTSEC-2023-0071 stops applying to native-only hosts once WP19 gates the compat planes),
-//! browser-compatible (an operator opens `/api/docs` in one, and no mainstream browser accepts an
-//! Ed25519 server cert), and carrying real SANs (localhost, loopback, the machine hostname) —
-//! which the legacy cert never had. The GameStream plane keeps the RSA identity untouched:
-//! Moonlight pins it and its pairing hashes bind its X.509 signature bytes.
+//! rcgen on the workspace's aws-lc-rs backend (no `rsa` crate on the native path, so the accepted
+//! Marvin advisory RUSTSEC-2023-0071 stops applying to native-only hosts once WP19 gates the
+//! compat planes), browser-compatible (an operator opens `/api/docs` in one, and no mainstream
+//! browser accepts an Ed25519 server cert), and carrying real SANs (localhost, loopback, the
+//! machine hostname) — which the legacy cert never had. The GameStream plane keeps the RSA
+//! identity untouched: Moonlight pins it and its pairing hashes bind its X.509 signature bytes.
 //!
 //! ## Migration — the rule that keeps every pinned fingerprint valid
 //!
@@ -73,9 +73,9 @@ pub fn load_or_adopt(np: &crate::native_pairing::NativePairing) -> Result<Native
     }
     // Live native pairings pinned the legacy RSA cert — switching identities now would strand
     // every one of them (the pin is the SHA-256 of the leaf DER). Keep serving what they pinned.
-    // A pem-only read on purpose (WP19): rustls/ring can SERVE an existing RSA cert without the
-    // `rsa` crate, so the native-only build never links it — the crate exists solely behind the
-    // `gamestream` feature (generation + the pairing signer).
+    // A pem-only read on purpose (WP19): rustls/aws-lc-rs can SERVE an existing RSA cert without
+    // the `rsa` crate, so the native-only build never links it — the crate exists solely behind
+    // the `gamestream` feature (generation + the pairing signer).
     if let (Ok(c), Ok(k)) = (
         fs::read_to_string(dir.join("cert.pem")),
         fs::read_to_string(dir.join("key.pem")),