howto/fabric.md

@@ -26,6 +26,17 @@ library, fetch it with:
     git clone https://gitlab.torproject.org/tpo/tpa/fabric-tasks.git &&
     cd fabric-tasks
 
+Don't trust the GitLab server! This should be done only once, in TOFU
+(Trust On First Use) mode: further uses of the repository should
+verify OpenPGP signatures or Git hashes from a known source.
+
+Normally, this is done on your laptop, not on the servers. Servers
+including the `profile::fabric` will have the code deployed globally
+(`/usr/local/lib/fabric-tasks` as of this writing), with the actual
+`fabric` package (and `fab` binary) available if `manage_package` is
+`true`. See [tpo/tpa/team#41484](https://gitlab.torproject.org/tpo/tpa/team/-/issues/41484) for the plans with that
+(currently progressive) deployment.
+
 ## Running a command on hosts
 
 Fabric can be used from the commandline to run arbitrary commands on