diff --git a/draft-miller-sshm-composite-sigs.xml b/draft-miller-sshm-composite-sigs.xml
index 1abb403..828e0ac 100644
--- a/draft-miller-sshm-composite-sigs.xml
+++ b/draft-miller-sshm-composite-sigs.xml
@@ -285,14 +285,13 @@
 		<section><name>Signature contexts</name>
 			<t>
 			The <xref target="I-D.ietf-lamps-pq-composite-sigs" />
-			composite signature scheme, like its
+			composite signature scheme used here, like its
 			underlying ML-DSA component, accepts a Context
-			parameter that may be used to enforce domain
-			separation between signatures.
+			parameter that is used to domain separate signatures.
 			</t>
 			<t>
 			In all cases in the SSH protocol, this
-			context value is the empty string.
+			context value MUST be the empty string.
 			</t>
 		</section>
 		<section anchor="sig"><name>Signature Generation</name>
@@ -319,8 +318,8 @@
 				to the signature algorithm.
 				</li>
 				<li>
-				len(ctx): A single byte representing
-				the length of the context string.
+				len(ctx): A single unsigned byte representing the length
+				of the context string.
 				</li>
 				<li>
 				ctx: The context string.
@@ -331,12 +330,10 @@
 				</li>
 			</ul>
 			<t>
-			The signer then computes and combines the ML-DSA and
-			Elliptic Curve signatures as described in the following
-			sections. In the algorithm invocations below, mldsa_sk,
-			ed25519_sk, and ecdsa_sk denote the private signing
-			keys derived from or represented by mldsa_seed,
-			ed25519_seed, and d, respectively.
+			The signer computes and combines the ML-DSA and Elliptic Curve
+			signatures. Below, mldsa_sk, ed25519_sk, and ecdsa_sk are the
+			private signing keys derived from or represented by
+			mldsa_seed, ed25519_seed, and d, respectively.
 			</t>
 			<section anchor="sig-ed"><name>ssh-mldsa44-ed25519</name>
 				<t>
@@ -348,8 +345,7 @@
 				creating the M' message to be signed.
 				</t>
 				<t>
-				The ML-DSA and Ed25519 signatures are then
-				calculated as:
+				The ML-DSA and Ed25519 signatures are calculated as:
 				</t>
 				<ul>
 				<li>
@@ -360,8 +356,8 @@
 				</li>
 				</ul>
 				<t>
-				The final composite signature is the
-				concatenation of mldsa_sig and ed25519_sig.
+				The final composite signature is the concatenation of
+				mldsa_sig and ed25519_sig in this order.
 				</t>
 				<sourcecode>
     byte[2420] mldsa_sig
@@ -383,8 +379,7 @@
 				the M' message to be signed.
 				</t>
 				<t>
-				The ML-DSA and ECDSA signatures are then
-				calculated as:
+				The ML-DSA and ECDSA signatures are calculated as:
 				</t>
 				<ul>
 				<li>
@@ -395,8 +390,8 @@
 				</li>
 				</ul>
 				<t>
-				The final composite signature is the
-				concatenation of mldsa_sig, r, and s.
+				The final composite signature is the concatenation of
+				mldsa_sig, r, and s in this order.
 				</t>
 				<sourcecode>
     byte[4896] mldsa_sig
@@ -431,20 +426,17 @@
 			</section>
 			<section><name>Signature Verification</name>
 				<t>
-				To verify a signature, the verifier
-				reconstructs M' using the same process as
-				defined for signature generation. The verifier then
-				verifies the ML-DSA and Elliptic Curve
-				signatures as described in the following
-				sections.
+				To verify a signature, the verifier reconstructs M'
+				using the same process as defined for signature
+				generation and verifies the ML-DSA and Elliptic Curve
+				signatures.
 				</t>
 				<t>
-				Both verification operations MUST return success
-				for the composite signature to verify
-				successfully. Failure
-				of either the ML-DSA or Elliptic Curve
-				verification MUST cause the verification of
-				the composite signature to fail.
+				Both ML-DSA and Elliptic Curve verification operations
+				MUST return success for the composite signature to
+				verify successfully. Failure of either verification
+				operation MUST cause the composite signature
+				verification to fail.
 				</t>
 				<section><name>ssh-mldsa44-ed25519</name>
 				<t>
@@ -460,7 +452,8 @@
 					</li>
 				</ul>
 				<t>
-				The verifier then checks both results as described above.
+				Both signatures must verify for the composite signature
+				to verify.
 				</t>
 				</section>
 				<section><name>ssh-mldsa87-p384</name>
@@ -477,7 +470,8 @@
 					</li>
 				</ul>
 				<t>
-				The verifier then checks both results as described above.
+				Both signatures must verify for the composite signature
+				to verify.
 				</t>
 				</section>
 			</section>