+<note>
+The differences between the three KDM types are fairly subtle.
+<guilabel>DCI Specific</guilabel> and <guilabel>DCI Any</guilabel> add
+a <code><ContentAuthenticator></code> tag to the KDM which
+allows the exhibitor to check that the DCP and KDM have come from a
+bona-fide source. In addition, <guilabel>DCI Specific</guilabel> adds
+information on trusted devices to the KDM. This allows the KDM
+creator to specify devices (such as sound processors) that are allowed
+to use keys delivered by the KDM. At present it is not clear how
+widely the <guilabel>DCI Specific</guilabel> and <guilabel>DCI
+Any</guilabel> features are supported (or even tolerated) by servers
+so you are advised to use <guilabel>Modified Transitional
+1</guilabel>.
+</note>
+