diff --git a/README.md b/README.md
index 7de37059..18fea932 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,11 @@ Goblin is a fork of the **Grim** egui GRIN wallet: it keeps Grim's full GRIN nod
 - **Manual slatepacks too** - when you need to pay or get paid without a handle, **Settings → Wallet → Slatepacks** exposes the classic by-hand flow: create a slatepack to send, or paste one to receive, finalize, or pay.
 - **Open-to-pay links** - a `goblin:` or `nostr:` pay link, or a scanned checkout QR, opens the wallet straight to a prefilled review screen (recipient, amount and note filled in, ready to hold-to-send) on desktop, macOS and Android.
 - **Proofs on request** - payments can include a native Grin payment proof when the payment request asks for one, off by default, shown on the review screen. An ordinary person-to-person send carries none.
-- **In-app identity** - a nostr payment key that is deliberately *not* part of your seed, so you can rotate it any time to stay unlinkable without touching your funds. An optional human-readable `name` comes from the goblin.st identity service.
+- **In-app identities** - one wallet holds many nostr payment keys, each deliberately *not* part of your seed, so you can rotate or switch between them any time to stay unlinkable without touching your funds. Generate a fresh identity, import an existing one (`nsec` or `.backup`), and switch the active one from the identity switcher. An optional human-readable `name` per identity comes from the goblin.st identity service.
+- **Sign in with Goblin** - a site can ask your wallet to prove who you are with a one-time login. You review the requesting domain and approve once; the wallet signs a single [kind 22242](https://nostrbook.dev/kinds/22242) login event and returns to the calling app. A login is never signed silently by any granted session.
+- **Authorize** - a site can request a single nostr event be signed. You see exactly what is being signed and approve it one time with your password; nothing is remembered.
+- **Authorize Sessions** - grant a trusted site a session so it can sign low-risk events (messaging, listings) silently for its duration, while money-tier actions always ask for your password every single time. Money tier is kinds [17](https://nostrbook.dev/kinds/17) and [30402](https://nostrbook.dev/kinds/30402), which are never covered by a session grant. Every active grant is listed under **Settings → Trusted Sites**, where you can review what each site can sign and revoke it.
+- **Merchant invoicing** - a batch invoice link is approved once, and each sale draws its own fresh proof address so receipts stay distinct without extra taps.
 - **Private by construction** - GRIN's address-less, confidential chain; your payments and identity (nostr relays, NIP-05 lookups, price) are routed through [Tor](https://www.torproject.org), so who-pays-whom never touches the clear net. The GRIN node connection - block sync and broadcasting your transaction - is direct: public chain data, the same for everyone, and not tied to your identity. Keys, names and history stay on your device.
 - **Configurable amount pairing** - show balances against a world currency, Bitcoin, or sats (rates fetched over Tor), or turn the preview off.
 - **News on Home** - the latest post from the official Goblin news key (a [kind 30023](https://nostrbook.dev/kinds/30023) long-form article) appears on the Home screen in your wallet's language, falling back to English; it stays hidden when there is nothing to show, and only ever shows the newest article.