diff --git a/PROTOCOL.u2f b/PROTOCOL.u2f
index 32bfa20f3..066d09951 100644
--- a/PROTOCOL.u2f
+++ b/PROTOCOL.u2f
@@ -170,6 +170,10 @@ is signed over a blob that consists of:
 	byte[]		extensions
 	byte[32]	SHA256(message)
 
+No extensons are yet defined for SSH use. If any are defined in the future,
+it will be possible to infer their presence from the contents of the "flags"
+value.
+
 The signature returned from U2F hardware takes the following format:
 
 	byte		flags (including "user present")