Let's go directly to Hixie:
HTML Standard
Comments must start with the four character sequence U+003C LESS-THAN SIGN, U+0021 EXCLAMATION MARK, U+002D HYPHEN-MINUS, U+002D HYPHEN-MINUS (<!--). Following this sequence, the comment may have text, with the additional restriction that the text must not start with a single U+003E GREATER-THAN SIGN character (>), nor start with a U+002D HYPHEN-MINUS character (-) followed by a U+003E GREATER-THAN SIGN (>) character, nor contain two consecutive U+002D HYPHEN-MINUS characters (--), nor end with a U+002D HYPHEN-MINUS character (-). Finally, the comment must be ended by the three character sequence U+002D HYPHEN-MINUS, U+002D HYPHEN-MINUS, U+003E GREATER-THAN SIGN (-->).
That clears things up nicely, and doesn't require SGML pendantry. Double-hyphens are forbidden in comment tags, except for the two in the prologue and the two in the epilogue.
Now, let's look at the parser implementation...
* TwelveBaud reads...
Ah. In the event you fuck it up in this way, a parse error is thrown, but if the parser elects to continue it includes the two hyphens and goes directly back to the comment state.