diff --git a/cmd/cashier/client/client.go b/cmd/cashier/client/client.go
index d8def27ce8e6c85f4b61ef224e44059e318b5f0e..ba5b9004cf4a3c85c8803d3585f99a55bea0aca3 100644
--- a/cmd/cashier/client/client.go
+++ b/cmd/cashier/client/client.go
@@ -78,12 +78,14 @@ func send(s []byte, token, ca string, ValidateTLSCertificate bool) (*lib.SignRes
 	return c, nil
 }
 
+// Sign sends the public key to the CA to be signed.
 func Sign(pub ssh.PublicKey, token string, conf *Config) (*ssh.Certificate, error) {
 	validity, err := time.ParseDuration(conf.Validity)
 	if err != nil {
 		return nil, err
 	}
 	marshaled := ssh.MarshalAuthorizedKey(pub)
+	// Remove the trailing newline.
 	marshaled = marshaled[:len(marshaled)-1]
 	s, err := json.Marshal(&lib.SignRequest{
 		Key:        string(marshaled),
diff --git a/cmd/cashier/client/config.go b/cmd/cashier/client/config.go
index d4defef71145d1f0c8f98da7af81cba3823edd37..1cc9401fc6a2a340e5d5d77979b5926e0e9f2f8e 100644
--- a/cmd/cashier/client/config.go
+++ b/cmd/cashier/client/config.go
@@ -5,6 +5,7 @@ import (
 	"github.com/spf13/viper"
 )
 
+// Config holds the client configuration.
 type Config struct {
 	CA                     string `mapstructure:"ca"`
 	Keytype                string `mapstructure:"key_type"`
@@ -21,6 +22,7 @@ func setDefaults() {
 	viper.SetDefault("validateTLSCertificate", true)
 }
 
+// ReadConfig reads the client configuration from a file into a Config struct.
 func ReadConfig(path string) (*Config, error) {
 	setDefaults()
 	viper.SetConfigFile(path)
diff --git a/cmd/cashier/client/keys.go b/cmd/cashier/client/keys.go
index 877ff42924df243080f92847880959d3c2f4a0bb..4b3b69e20140a32cefd22779010066c0f1282c08 100644
--- a/cmd/cashier/client/keys.go
+++ b/cmd/cashier/client/keys.go
@@ -11,6 +11,7 @@ import (
 	"golang.org/x/crypto/ssh"
 )
 
+// Key is a private key.
 type Key interface{}
 type keyfunc func(int) (Key, ssh.PublicKey, error)
 
@@ -69,6 +70,7 @@ func generateECDSAKey(bits int) (Key, ssh.PublicKey, error) {
 	return k, pub, nil
 }
 
+// GenerateKey generates a ssh key-pair according to the type and size specified.
 func GenerateKey(keytype string, bits int) (Key, ssh.PublicKey, error) {
 	f, ok := keytypes[keytype]
 	if !ok {