make it clear that key pairs are created per connection

site/how-it-works.md

@@ -114,14 +114,13 @@ poorly documented, and easily used wrongly.
 
 #### Establishing the Ephemeral Session Key
 
-When a weave peer has been started with the `-password` option, the
-initial handshake between the peers over TCP includes the exchange of
-the peers' public keys. Each peer generates a fresh public and private
-key pair for each connection, and these are created from the NaCl
-crypto library's `GenerateKey` function. Peers that were started with
-`-password` do not continue with connection establishment unless they
-receive a public key from the remote peer. Thus either all peers in a
-weave network must be started with `-password`, or none of them.
+For every connection between peers, a fresh public/private key pair is
+created at both ends, using NaCl's `GenerateKey` function, and the
+public key portion is sent to the other end as part of the initial
+handshake performed over TCP. Peers that were started with `-password`
+do not continue with connection establishment unless they receive a
+public key from the remote peer. Thus either all peers in a weave
+network must be started with `-password`, or none of them.
 
 When a peer has received a public key from the remote peer, it uses
 this to form the ephemeral session key for this connection. The public