diff --git a/api/utils/keypaths/keypaths.go b/api/utils/keypaths/keypaths.go
index 763e49e2133..c6dffaace5d 100644
--- a/api/utils/keypaths/keypaths.go
+++ b/api/utils/keypaths/keypaths.go
@@ -82,19 +82,19 @@ const (
 //    │   ├── foo-ssh                  --> SSH certs for user "foo"
 //    │   │   ├── root-cert.pub        --> SSH cert for Teleport cluster "root"
 //    │   │   └── leaf-cert.pub        --> SSH cert for Teleport cluster "leaf"
-//    │   ├── foo-app                  --> Database access certs for user "foo"
-//    │   │   ├── root                 --> Database access certs for cluster "root"
+//    │   ├── foo-app                  --> App access certs for user "foo"
+//    │   │   ├── root                 --> App access certs for cluster "root"
 //    │   │   │   ├── appA-x509.pem    --> TLS cert for app service "appA"
 //    │   │   │   └── appB-x509.pem    --> TLS cert for app service "appB"
 //    │   │   │   └── appB-localca.pem --> Self-signed localhost CA cert for app service "appB"
-//    │   │   └── leaf                 --> Database access certs for cluster "leaf"
+//    │   │   └── leaf                 --> App access certs for cluster "leaf"
 //    │   │       └── appC-x509.pem    --> TLS cert for app service "appC"
-//    │   ├── foo-db                   --> App access certs for user "foo"
-//    │   │   ├── root                 --> App access certs for cluster "root"
+//    │   ├── foo-db                   --> Database access certs for user "foo"
+//    │   │   ├── root                 --> Database access certs for cluster "root"
 //    │   │   │   ├── dbA-x509.pem     --> TLS cert for database service "dbA"
 //    │   │   │   ├── dbB-x509.pem     --> TLS cert for database service "dbB"
 //    │   │   │   └── dbC-wallet       --> Oracle Client wallet Configuration directory.
-//    │   │   ├── leaf                 --> App access certs for cluster "leaf"
+//    │   │   ├── leaf                 --> Database access certs for cluster "leaf"
 //    │   │   │   └── dbC-x509.pem     --> TLS cert for database service "dbC"
 //    │   │   └── proxy-localca.pem    --> Self-signed TLS Routing local proxy CA
 //    │   ├── foo-kube                 --> Kubernetes certs for user "foo"