diff --git a/book/source/04-certificates.md b/book/source/04-certificates.md
index f3d3bbd..637b048 100644
--- a/book/source/04-certificates.md
+++ b/book/source/04-certificates.md
@@ -247,16 +247,6 @@ This presupposes that Bob knows this person who goes by "Alice Adams", and is sa
 
 For more on third-party certifications, see {ref}`third_party_cert`.
 
-### Security considerations
-
-While a convenience for consumers, indiscriminately accepting and integrating third-party identity certifications comes with significant risks. 
-
-Without any restrictions in place, malicious entities can flood a certificate with excessive certifications. Called "certificate flooding," this form of digital vandalism grossly expands the certificate size, making the certificate cumbersome and impractical for users.  
-
-It also opens the door to potential denial-of-service attacks, rendering the certificate non-functional or significantly impeding its operation. 
-
-The popular [SKS keyserver network experienced certificate flooding firsthand](https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html), causing it to shut down operations in 2019. 
-
 ## Advanced topics
 
 ```{admonition} TODO
@@ -323,3 +313,13 @@ references/links missing
 ```
 
 Some OpenPGP subsystems may add User IDs to a certificate, which are not bound to the primary key by the certificate's owner. This can be useful to store local identity information (e.g., Sequoia's public store attaches "pet-names" to certificates, in this way).
+
+### Third-party certification flooding
+
+While a convenience for consumers, indiscriminately accepting and integrating third-party identity certifications comes with significant risks.
+
+Without any restrictions in place, malicious entities can flood a certificate with excessive certifications. Called "certificate flooding," this form of digital vandalism grossly expands the certificate size, making the certificate cumbersome and impractical for users.
+
+It also opens the door to potential denial-of-service attacks, rendering the certificate non-functional or significantly impeding its operation.
+
+The popular [SKS keyserver network experienced certificate flooding firsthand](https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html), causing it to shut down operations in 2019.