diff --git a/authority/provisioner/sign_options.go b/authority/provisioner/sign_options.go
index 00b5c7f4..3da08bec 100644
--- a/authority/provisioner/sign_options.go
+++ b/authority/provisioner/sign_options.go
@@ -426,7 +426,6 @@ func (o *provisionerExtensionOption) Option(Options) x509util.WithOption {
 		if err != nil {
 			return err
 		}
-		// NOTE: HACK.
 		// Prepend the provisioner extension. In the auth.Sign code we will
 		// force the resulting certificate to only have one extension, the
 		// first stepOIDProvisioner that is found in the ExtraExtensions.