1 files changed, 19 insertions, 11 deletions
diff --git a/ssh-agent.0 b/ssh-agent.0
index 2c7b86034725..f56cb4f85081 100644
--- a/ssh-agent.0
+++ b/ssh-agent.0
@@ -40,16 +40,24 @@ DESCRIPTION
              variable).
 
      -O option
-             Specify an option when starting ssh-agent.  Currently only one
-             option is supported: no-restrict-websafe.  This instructs
-             ssh-agent to permit signatures using FIDO keys that might be web
-             authentication requests.  By default, ssh-agent refuses signature
-             requests for FIDO keys where the key application string does not
-             start with M-bM-^@M-^\ssh:M-bM-^@M-^] and when the data to be signed does not appear
-             to be a ssh(1) user authentication request or a ssh-keygen(1)
-             signature.  The default behaviour prevents forwarded access to a
-             FIDO key from also implicitly forwarding the ability to
-             authenticate to websites.
+             Specify an option when starting ssh-agent.  Currently two options
+             are supported: allow-remote-pkcs11 and no-restrict-websafe.
+
+             The allow-remote-pkcs11 option allows clients of a forwarded
+             ssh-agent to load PKCS#11 or FIDO provider libraries.  By default
+             only local clients may perform this operation.  Note that
+             signalling that a ssh-agent client remote is performed by ssh(1),
+             and use of other tools to forward access to the agent socket may
+             circumvent this restriction.
+
+             The no-restrict-websafe, instructs ssh-agent to permit signatures
+             using FIDO keys that might be web authentication requests.  By
+             default, ssh-agent refuses signature requests for FIDO keys where
+             the key application string does not start with M-bM-^@M-^\ssh:M-bM-^@M-^] and when
+             the data to be signed does not appear to be a ssh(1) user
+             authentication request or a ssh-keygen(1) signature.  The default
+             behaviour prevents forwarded access to a FIDO key from also
+             implicitly forwarding the ability to authenticate to websites.
 
      -P allowed_providers
              Specify a pattern-list of acceptable paths for PKCS#11 provider
@@ -128,4 +136,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 7.2                     October 7, 2022                    OpenBSD 7.2
+OpenBSD 7.3                     October 7, 2022                    OpenBSD 7.3