diff --git a/mesh/protocol_crypto.go b/mesh/protocol_crypto.go
index db0b5f68..2adb6921 100644
--- a/mesh/protocol_crypto.go
+++ b/mesh/protocol_crypto.go
@@ -35,7 +35,8 @@ func FormSessionKey(remotePublicKey, localPrivateKey *[32]byte, secretKey []byte
 // sender - '1' for outbound; the next indicates protocol type - '1'
 // for TCP. The remaining 126 bits are zero. The polarity is needed so
 // that the two ends of a connection do not use the same nonces; the
-// protocol type so that the TCP and UDP sender nonces are disjoint.
+// protocol type so that the TCP connection nonces are distinct from
+// nonces used by overlay connections, if they share the session key.
 // This is a requirement of the NaCl Security Model; see
 // http://nacl.cr.yp.to/box.html.
 type TCPCryptoState struct {
@@ -49,7 +50,6 @@ func NewTCPCryptoState(sessionKey *[32]byte, outbound bool) *TCPCryptoState {
 	if outbound {
 		s.nonce[0] |= (1 << 7)
 	}
-	// Ensure that TCP and UDP sequences are disjoint
 	s.nonce[0] |= (1 << 6)
 	return s
 }
diff --git a/mesh/router.go b/mesh/router.go
index 55c34c7d..916ea5b7 100644
--- a/mesh/router.go
+++ b/mesh/router.go
@@ -109,9 +109,6 @@ func (router *Router) listenTCP(localPort int) {
 }
 
 func (router *Router) acceptTCP(tcpConn *net.TCPConn) {
-	// someone else is dialing us, so our udp sender is the conn
-	// on router.Port and we wait for them to send us something on UDP to
-	// start.
 	remoteAddrStr := tcpConn.RemoteAddr().String()
 	log.Printf("->[%s] connection accepted", remoteAddrStr)
 	connRemote := NewRemoteConnection(router.Ourself.Peer, nil, remoteAddrStr, false, false)