diff --git a/apps/i2ptunnel/jsp/editServer.jsi b/apps/i2ptunnel/jsp/editServer.jsi
index cbf5cb9ca..5871e744a 100644
--- a/apps/i2ptunnel/jsp/editServer.jsi
+++ b/apps/i2ptunnel/jsp/editServer.jsi
@@ -452,8 +452,8 @@
 <%
                 } // mode = 10
 %>
-                <option title="<%=intl._t("Send key to all users.")%>" value="1" <%=(curEncryptMode.equals("1") ? " selected=\"selected\"" : cdisabled)%> >
-                    <%=intl._t("Encrypted")%> (AES)</option>
+                <option title="<%=intl._t("Send key to all users.")%> <%=intl._t("Legacy option (deprecated), provided for backward compatibility")%>" value="1" <%=(curEncryptMode.equals("1") ? " selected=\"selected\"" : cdisabled)%> >
+                    <%=intl._t("Encrypted")%> (Deprecated LS1 AES)</option>
 <%
                 int curSigType = editBean.getSigType(curTunnel, tunnelType);
                 boolean allowBlinding = (curSigType == 7 || curSigType == 11);
diff --git a/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHelper.java b/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHelper.java
index 450ad5934..add3bfa3f 100644
--- a/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHelper.java
+++ b/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHelper.java
@@ -94,7 +94,7 @@ public class ConfigKeyringHelper extends HelperBase {
             }
             buf.append("</td><td>");
             if (!local)
-                buf.append(_t("Encrypted")).append(" (AES)</td><td>");
+                buf.append(_t("Encrypted")).append(" (Deprecated LS1 AES)</td><td>");
             SessionKey sk = e.getValue();
             buf.append(sk.toBase64());
             if (!local)
diff --git a/apps/routerconsole/jsp/configkeyring.jsp b/apps/routerconsole/jsp/configkeyring.jsp
index 5b495264d..614a199a7 100644
--- a/apps/routerconsole/jsp/configkeyring.jsp
+++ b/apps/routerconsole/jsp/configkeyring.jsp
@@ -40,7 +40,7 @@
           <td align="right"><b><%=intl._t("Type")%>:</b></td>
           <td><select id="encryptMode" name="encryptMode" class="selectbox">
           <option title="<%=intl._t("Enter key provided by server operator.")%>" value="1">
-              <%=intl._t("Encrypted")%> (AES)</option>
+              <%=intl._t("Encrypted")%> (Deprecated LS1 AES)</option>
           <option title="<%=intl._t("Prevents server discovery by floodfills")%>" value="2">
               <%=intl._t("Blinded")%></option>
           <option title="<%=intl._t("Enter password provided by server operator.")%>" value="3">
diff --git a/core/java/src/net/i2p/I2PAppContext.java b/core/java/src/net/i2p/I2PAppContext.java
index 553fd1bdb..b113693c1 100644
--- a/core/java/src/net/i2p/I2PAppContext.java
+++ b/core/java/src/net/i2p/I2PAppContext.java
@@ -864,7 +864,11 @@ public class I2PAppContext {
     }
     
     /**
-     * Basic hash map
+     *  Basic hash map for LS1
+     *
+     *  Deprecated -
+     *  This is for the deprecated LS1 AES encrypted leasesets only.
+     *  LS2 encrypted leaseset data are stored in netdb BlindCache and router.blindcache.dat.
      */
     public KeyRing keyRing() {
         if (!_keyRingInitialized)
diff --git a/core/java/src/net/i2p/util/KeyRing.java b/core/java/src/net/i2p/util/KeyRing.java
index d323dd00c..9769a008d 100644
--- a/core/java/src/net/i2p/util/KeyRing.java
+++ b/core/java/src/net/i2p/util/KeyRing.java
@@ -9,7 +9,11 @@ import net.i2p.data.Hash;
 import net.i2p.data.SessionKey;
 
 /**
- *  simple
+ *  See net.i2p.router.PersistentKeyRing for extension.
+ *
+ *  Deprecated -
+ *  This is for the deprecated LS1 AES encrypted leasesets only.
+ *  LS2 encrypted leaseset data are stored in netdb BlindCache and router.blindcache.dat.
  */
 public class KeyRing extends ConcurrentHashMap<Hash, SessionKey> {
     public KeyRing() {
diff --git a/router/java/src/net/i2p/router/PersistentKeyRing.java b/router/java/src/net/i2p/router/PersistentKeyRing.java
index 5ad911618..016cf91b6 100644
--- a/router/java/src/net/i2p/router/PersistentKeyRing.java
+++ b/router/java/src/net/i2p/router/PersistentKeyRing.java
@@ -13,6 +13,10 @@ import net.i2p.util.KeyRing;
  *  ConcurrentHashMap with backing in the router.config file.
  *  router.keyring.key.{base64 hash, with = replaced with $}={base64 session key}
  *  Caution - not all HashMap methods are overridden.
+ *
+ *  Deprecated -
+ *  This is for the deprecated LS1 AES encrypted leasesets only.
+ *  LS2 encrypted leaseset data are stored in netdb BlindCache and router.blindcache.dat.
  */
 public class PersistentKeyRing extends KeyRing {
 
diff --git a/router/java/src/net/i2p/router/RouterContext.java b/router/java/src/net/i2p/router/RouterContext.java
index cd6b44056..6668a4dc7 100644
--- a/router/java/src/net/i2p/router/RouterContext.java
+++ b/router/java/src/net/i2p/router/RouterContext.java
@@ -560,7 +560,15 @@ public class RouterContext extends I2PAppContext {
         }
     }
 
-    /** override to support storage in router.config */
+    /**
+     *  Basic hash map for LS1
+     *
+     *  overriden to support storage in router.config
+     *
+     *  Deprecated -
+     *  This is for the deprecated LS1 AES encrypted leasesets only.
+     *  LS2 encrypted leaseset data are stored in netdb BlindCache and router.blindcache.dat.
+     */
     @Override
     public KeyRing keyRing() {
         if (!_keyRingInitialized)