diff --git a/static/build.html b/static/build.html
index 92f0bbda..7cedd57e 100644
--- a/static/build.html
+++ b/static/build.html
@@ -427,9 +427,9 @@ mv vendor/android-prepare-vendor/DEVICE/BUILD_ID/vendor/google_devices/* vendor/
 
             <p>The keys should not be given passwords due to limitations in the upstream scripts.
             If you want to secure them at rest, you should take a different approach where they
-            can still be available to the signing scripts as a directory of unencrypted keys. The
-            sample certificate subject can be replaced with your own information or simply left
-            as-is.</p>
+            can still be available to the signing scripts as a directory of unencrypted keys.</p>
+
+            <p>The sample certificate subject should be replaced with your own information.</p>
 
             <p>To generate keys for crosshatch (you should use unique keys per device
             variant):</p>