1 files changed, 18 insertions, 7 deletions

diff --git a/sshd_config.5 b/sshd_config.5
index b294efc2d..6fa421cae 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.311 2020/04/17 06:12:41 jmc Exp $
-.Dd $Mdocdate: April 17 2020 $
+.\" $OpenBSD: sshd_config.5,v 1.315 2020/08/27 12:34:00 jmc Exp $
+.Dd $Mdocdate: August 27 2020 $
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -817,7 +817,7 @@ The default is
 Include the specified configuration file(s).
 Multiple pathnames may be specified and each pathname may contain
 .Xr glob 7
-wildcards.
+wildcards that will be expanded and processed in lexical order.
 Files without absolute paths are assumed to be in
 .Pa /etc/ssh .
 An
@@ -1476,11 +1476,12 @@ The list of available key types may also be obtained using
 .Qq ssh -Q PubkeyAcceptedKeyTypes .
 .It Cm PubkeyAuthOptions
 Sets one or more public key authentication options.
-Two option keywords are currently supported:
+The supported keywords are:
 .Cm none
-(the default; indicating no additional options are enabled)
+(the default; indicating no additional options are enabled),
+.Cm touch-required
 and
-.Cm touch-required .
+.Cm verify-required .
 .Pp
 The
 .Cm touch-required
@@ -1497,7 +1498,17 @@ requires user presence unless overridden with an authorized_keys option.
 The
 .Cm touch-required
 flag disables this override.
-This option has no effect for other, non-authenticator public key types.
+.Pp
+The
+.Cm verify-required
+option requires a FIDO key signature attest that the user was verified,
+e.g. via a PIN.
+.Pp
+Neither the
+.Cm touch-required
+or
+.Cm verify-required
+options have any effect for other, non-FIDO, public key types.
 .It Cm PubkeyAuthentication
 Specifies whether public key authentication is allowed.
 The default is