diff --git a/gtk2_ardour/ardour_http.cc b/gtk2_ardour/ardour_http.cc
index 5a60b03aab..19895caaa5 100644
--- a/gtk2_ardour/ardour_http.cc
+++ b/gtk2_ardour/ardour_http.cc
@@ -80,6 +80,7 @@ HttpGet::setup_certificate_paths ()
 	 *
 	 * Short of this mess: we could simply bundle a .crt of
 	 * COMODO (ardour) and ghandi (freesound) and be done with it.
+	 * Alternatively, ship the Mozilla CA list, perhaps using https://mkcert.org/ .
 	 */
 	assert (!ca_path && !ca_info); // call once