diff --git a/README.md b/README.md
new file mode 100644
index 0000000..94342ca
--- /dev/null
+++ b/README.md
@@ -0,0 +1,36 @@
+# tlskit
+
+The HTTP/TLS client shared by the Android 2.2/2.3 apps: [Plexamp Lite](https://git.anosanube.ovh/xocko/plexamp-lite),
+[Podlite](https://git.anosanube.ovh/xocko/podlite), [Noticias Lite](https://git.anosanube.ovh/xocko/noticias-lite)
+and [Calendar Lite](https://git.anosanube.ovh/xocko/calendar-lite).
+
+Android 2.x's own SSL stops at TLS 1.0 and lacks today's root certificates, so modern `https://` servers
+(Let's Encrypt, Pangolin, Cloudflare…) refuse it. This kit brings its own TLS 1.2 instead:
+
+- `net/Http.java`: a small HTTP/1.1 client on Bouncy Castle TLS 1.2 (renamed to `com.minamp.bc`, so it
+  doesn't clash with the old copy inside Android), with keep-alive pooling, session resumption and
+  chunked bodies
+- `net/CertVerifier.java`: host name, validity dates and the chain up to a bundled Mozilla root; optionally one
+  pinned leaf certificate (SHA-256) for self-signed servers, with the fingerprint shown so the user can confirm it
+- `net/AssetRoots.java` + `roots/`: Mozilla's root store (121 roots) as `assets/roots/<sha1(subject)>-<n>.der`
+- `net/Threads.java`: threads with a 256 KB stack. Network work on Android 2.x must run on one, or the
+  handshake overflows the default stack
+- `net/DiagLog.java`: connection log, with tokens removed from URLs
+
+## Use
+
+```sh
+./install.sh <app dir> <java package>      # e.g. ./install.sh ../noticias-lite org.freshmini.net
+```
+
+It copies `net/` into the app under that package and `roots/` into the app's `assets/`. Calendar Lite keeps
+its copy under `android/org/gingercal/net` (copy by hand there). The apps carry copies, not a dependency:
+when changing the kit, change it here and reinstall it into every app.
+
+The Bouncy Castle sources come from Plexamp Lite's `tools/setup_toolchain.sh` (`~/android-toolchain/bcsrc`);
+roots are regenerated with its `tools/make_roots.py`.
+
+## Test
+
+`test/KitTest.java` runs the client on a desktop JVM against real servers (FreshRSS, Nextcloud,
+Audiobookshelf).
diff --git a/install.sh b/install.sh
index a84d81b..3fe88d7 100755
--- a/install.sh
+++ b/install.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # Copies the bundled-TLS network package into an app: ./install.sh <app dir> <java package>
-# e.g. ./install.sh ../newslite org.freshmini.net
+# e.g. ./install.sh ../noticias-lite org.freshmini.net
 set -euo pipefail
 here=$(cd "$(dirname "$0")" && pwd)
 app=$1 pkg=$2