--- a/Overview.html	Wed Jul 03 14:20:59 2013 -0400
+++ b/Overview.html	Wed Jul 03 14:45:54 2013 -0400
@@ -409,7 +409,7 @@
 
    1. Assume a combined assertion and certificate structure in JWT format for use with postMessage()
       var assertionPlusCert is a JWT like above
-   2. Extract karen@webcrypto.com public key for use with postMessage()
+   2. Extract karen@webcrypto.com private key for signing assertion
    3. Send the certificate structure assertionPlusCert over for verification
    
    Caveat emptor: step 3 can be made more efficient in terms of Web Crypto API usage if
@@ -420,8 +420,9 @@
 
 
 transaction.objectStore("publicBrowserIDKeys").get("karen@webcrypto.com").onsuccess = function(evt) {
-  var publicKey = event.target.result;
+  var privateKey = event.target.result;
 
+// Sign the assertion -- see signature example (TODO)
 // Send the assertionPlusCert structure to script on photosharingsite.example
 
   pssHandle.postMessage(assertionPlusCert, "http://photosharingsite.example");