r11413: More comments, plus always check (and update) the credentials chain,