add detail on OTP implementation

README.md

@@ -110,6 +110,17 @@ method. The comment is a free-form string set by the user to tell the
 various credentials apart.
 
 
+## OTP implementation
+
+The authentication server uses a very simple implementation of
+time-based OTP (TOTP), supporting a single secret per user and without
+any fancy features such as emergency tokens etc. The reason for this
+is that TOTP authentication requires just plain read-only access to
+the user database, while counter-based authentication with proper
+token revocation is a read-write, locked operation which is more
+difficult to perform on a LDAP backend.
+
+
 # Usage
 
 ## Client authentication