Add comment to README

Author: mdmathias

README.md

@@ -107,3 +107,30 @@ let signInButton = GoogleSignInButton {
 }
 let hostedButton = NSHostingView(rootView: signInButton)
 ```
+
+## A Note iOS Keychain Access Groups
+
+On iOS, if you do not supply a custom Keychain access group, the system creates
+a Keychain access group by prepending `$(AppIdentifierPrefix)` to your bundle
+ID (e.g., `$(AppIdentifierPrefix).com.example.MyApp`), which becomes the
+default access group for just your app ([Apple documentation](https://developer.apple.com/documentation/security/sharing-access-to-keychain-items-among-a-collection-of-apps#Establish-your-apps-private-access-group)).
+
+If, however, you add a new Keychain access group (and add the entitlement to
+your app), then Xcode will use whatever access group is listed first in the
+list as the default. So, if the shared access group is first, then it becomes
+the default Keychain for your app.
+
+The implication of this scenario is that credentials saved by GSI (via
+[GTMAppAuth](https://github.com/google/GTMAppAuth)) on behalf of your app will
+be stored in the shared keychain access group.
+
+You should make sure that you want this behavior because GSI [removes Keychain
+items upon fresh install](https://github.com/google/GoogleSignIn-iOS/pull/567)
+to ensure that stale credentials from previous installs of your app are not
+mistakenly used. This behavior can lead new installs of apps sharing the same
+Keychain access group to remove Keychain credentials for apps already installed.
+
+You can mitigate this by explicitly listing the typical default access group
+(or whatever you prefer) in your list first. GSI, via GTMAppAuth, will then use
+that default access group. Make sure that you also update your code that writes
+to the Keychain to explicitly use the shared access group as needed.