diff --git a/node.js b/node.js
index 244abf8..caaf61d 100644
--- a/node.js
+++ b/node.js
@@ -148,6 +148,7 @@ ACME._registerAccount = function (me, options) {
         , contact: contact
         };
         if (options.externalAccount) {
+          // TODO is this really done by HMAC or is it arbitrary?
           body.externalAccountBinding = me.RSA.signJws(
             options.externalAccount.secret
           , undefined
diff --git a/package.json b/package.json
index 6d3cfe2..804bed8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "acme-v2",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Free SSL. A framework for building Let's Encrypt v2 clients, and other ACME v2 (draft 11) clients. Successor to le-acme-core.js",
   "homepage": "https://git.coolaj86.com/coolaj86/acme-v2.js",
   "main": "node.js",