diff --git a/doc/design.md b/doc/design.md
index 984fc56c..78d631d9 100644
--- a/doc/design.md
+++ b/doc/design.md
@@ -33,3 +33,6 @@ Download mesh management is identical to Gnutella, except instead of ip addresse
 
 Nodes will periodically ping a pre-defined Destination for a JSON document containing the infohash of a new binary update package using signed datagrams.  If the response indicates a newer version is available, the node will issue an automatic search for that infohash and download it, then prompt the user to install the update.
 
+### Web Of Trust
+
+Users may choose to "Trust" or "Blacklist" Destinations that return search results.  This trust is local to the user, but it can be shared with others.  Upon installation the user picks a username which does not need to be unique, but from which a globally unique "persona" is created by concatenating the human-readable username with @ and the b32 hash of the destination of their node.  This persona is returned together with search results and when displayed in the UI the user is given the choice to trust or distrust them.
diff --git a/doc/wire-protocol.md b/doc/wire-protocol.md
index f6ea99b5..31cb557f 100644
--- a/doc/wire-protocol.md
+++ b/doc/wire-protocol.md
@@ -124,7 +124,7 @@ This message starts with two unsigned bytes indicating the number of patches inc
 
 ### Search results - any node to any node
 
-Search results are sent in "results" type connection from the responder to the originator of the query.  This connection is uncompressed and only Alice sends any data on it, i.e. there is no handshake.  The first thing that Alice sends is the UUID of the search that generated the results.  This allows Bob to drop the connection if he does not recognize that UUID.  After that, Alice sends a stream containing JSON messages prefixed by two unsigned bytes indicating the length of each message.  The format is the following:  
+Search results are sent in "results" type connection from the responder to the originator of the query.  This connection is uncompressed and only Alice sends any data on it, i.e. there is no handshake.  The first thing that Alice sends is the UUID of the search that generated the results.  This allows Bob to drop the connection if he does not recognize that UUID.  After that Alice sends her human-readable username so that Bob can choose whether to trust or distrust her.  After that, Alice sends a stream containing JSON messages prefixed by two unsigned bytes indicating the length of each message.  The format is the following:  
 
 ```
 {