diff --git a/lib/puppet.rb b/lib/puppet.rb
index <HASH>..<HASH> 100644
--- a/lib/puppet.rb
+++ b/lib/puppet.rb
@@ -208,6 +208,11 @@ module Puppet
         Puppet::Network::HTTP::NoCachePool.new
       },
       :ssl_host => proc { Puppet::SSL::Host.localhost },
+      # The indirector needs to disable certificate_revocation checking for the
+      # initial download of the CRL. Retrieving the setting from the context
+      # allows the indirector to call its `find` method within Context#override.
+      # If the indirector is no longer used for downloading the CRL then this
+      # may be removed (see PUP-8654).
       :certificate_revocation => proc { Puppet[:certificate_revocation] },
       :plugins => proc { Puppet::Plugins::Configuration.load_plugins }
     }
(maint) Explain why certificate_revocation is in base_context

It is non-obvious from a simple pass over the code that
certificate_revocation is in the base_context so that the indirector may
disable CRL checking when downloading the CRL for the first time.

This adds a comment to the base_context's certificate_revocation entry
explaining.