Be explicit about crlsMutex's use

Co-authored-by: Miciah Dashiel Butler Masters <[email protected]>

Author: rfredette

pkg/router/crl/crl.go

@@ -68,8 +68,10 @@ var (
 	// CABundleFilename is the fully qualified path to the currently in use CA bundle.
 	CABundleFilename = filepath.Join(mtlsLatestSymlink, caBundleBasename)
 	// crlsUpdated is true when all CRLs have been successfully updated, and false when there are missing CRLs.
+	// You must take crlsMutex before using crlsUpdated.  
 	crlsUpdated = false
-	crlsMutex   = sync.Mutex{}
+	// crlsMutex protects crlsUpdated.  
+	crlsMutex = sync.Mutex{}
 )
 
 // authorityKeyIdentifier is a certificate's authority key identifier.