diff --git a/bip-0138.md b/bip-0138.md
index 703d5a1b..16285cd2 100644
--- a/bip-0138.md
+++ b/bip-0138.md
@@ -112,15 +112,28 @@ hash construction from [BIP340](bip-0340.mediawiki#design).
 Because $s$ and $s_i$ use distinct domain-separation tags, $s \neq s_i$ and
 therefore $c_i$ is never the all-zero string.
 
-**Note:** To prevent attackers from decrypting the backup using publicly known
-keys, explicitly exclude any public keys with x coordinate
+Keys published on chain are already kept out of $\{p_1, \dots, p_n\}$ by the
+[Descriptor key requirements](#descriptor-key-requirements).
+Implementations MUST exclude the key with x coordinate
 `50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0` (the BIP341 NUMS
-point, used as a taproot internal key in some applications). Additionally, exclude any
-other publicly known keys.
+point). Applications MAY exclude any further key they know to be public.
 
-Applications that exclude additional keys SHOULD document this, although decryption
-using these keys will simply fail. This does not affect decryption with the remaining
-keys.
+Applications that exclude keys beyond the NUMS point SHOULD document which keys they
+exclude, so that users know which keys cannot open the backup. A cosigner holding an
+excluded key will simply fail to decrypt, while the cosigners holding the keys that
+remain in $\{p_1, \dots, p_n\}$ can still decrypt the backup.
+
+**Note:** A key is *publicly known* when a third party can learn it without the wallet
+owner disclosing it. There is no registry of such keys. In practice they come from two
+sources: the blockchain, and well-known constants.
+
+**Warning:** An xpub can be known to a third party without ever appearing on chain.
+Some single-signature wallets, such as the Ledger and Trezor desktop apps, send the
+BIP44/49/84/86 account xpub to a server, the server then derive every key from
+that xpub. For a single-signature descriptor this leaks little the server does not
+already know, but reusing such an xpub as a key of a multisig descriptor lets that
+server decrypt every backup of the multisig. Users SHOULD build a multisig from
+accounts whose xpub was never sent to such a server.
 
 ### Descriptor key requirements