diff --git a/src/secmod.mli b/src/secmod.mli
index 9262bf65..ff603db2 100644
--- a/src/secmod.mli
+++ b/src/secmod.mli
@@ -1,50 +1,52 @@
-(* TODO functorize *)
-open Crypto
+module type S = sig
+  open Crypto
 
-type t
+  type t
 
-val sign_with_sm_key : t -> string -> eddsa_sig
-val sign_with_signkey : t -> pub:eddsa_pub -> string -> eddsa_sig
-val verify_with_master_key : eddsa_sig -> msg:string -> (unit, string) result
-val verify_with_sm_key : t -> eddsa_sig -> msg:string -> (unit, string) result
+  val sign_with_sm_key : t -> string -> eddsa_sig
+  val sign_with_signkey : t -> pub:eddsa_pub -> string -> eddsa_sig
+  val verify_with_master_key : eddsa_sig -> msg:string -> (unit, string) result
+  val verify_with_sm_key : t -> eddsa_sig -> msg:string -> (unit, string) result
 
-val verify_with_signkey :
-  t -> pub:eddsa_pub -> eddsa_sig -> msg:string -> (unit, string) result
+  val verify_with_signkey :
+    t -> pub:eddsa_pub -> eddsa_sig -> msg:string -> (unit, string) result
 
-(* TODO query database instead? *)
-val get_sm_key_pub : t -> eddsa_pub
-val get_signkeys_data : t -> Signkey_data.t list
-val get_denoms_data : t -> Denom_data.t list
-val find_signkey_data : t -> eddsa_pub -> Signkey_data.t option
-val find_denom_data : t -> denomination_hash -> Denom_data.t option
-val find_denom_section_name : t -> denomination_hash -> string option
+  (* TODO query database instead? *)
+  val get_sm_key_pub : t -> eddsa_pub
+  val get_signkeys_data : t -> Signkey_data.t list
+  val get_denoms_data : t -> Denom_data.t list
+  val find_signkey_data : t -> eddsa_pub -> Signkey_data.t option
+  val find_denom_data : t -> denomination_hash -> Denom_data.t option
+  val find_denom_section_name : t -> denomination_hash -> string option
 
-(* - management operations - *)
-(* TODO
+  (* - management operations - *)
+  (* TODO
    problem of keeping db and secmod state syncronized
    do db interaction from secmod? *)
-val init : (module Pg.CONN) -> t
 
-val add_signkey_master_signatures :
-  (module Pg.CONN) ->
-  t ->
-  (eddsa_pub * Bin_sig.ExchangeSigningKeyValidity.t) list ->
-  (unit, string) result
+  val add_signkey_master_signatures :
+    (module Pg.CONN) ->
+    t ->
+    (eddsa_pub * Bin_sig.ExchangeSigningKeyValidity.t) list ->
+    (unit, string) result
 
-val add_denom_master_signatures :
-  (module Pg.CONN) ->
-  t ->
-  (denomination_hash * Bin_sig.DenominationKeyValidity.t) list ->
-  (unit, string) result
+  val add_denom_master_signatures :
+    (module Pg.CONN) ->
+    t ->
+    (denomination_hash * Bin_sig.DenominationKeyValidity.t) list ->
+    (unit, string) result
 
-val revoke_signkey :
-  t ->
-  eddsa_pub ->
-  Bin_sig.MasterSigningKeyRevocation.t ->
-  (unit, string) result
+  val revoke_signkey :
+    t ->
+    eddsa_pub ->
+    Bin_sig.MasterSigningKeyRevocation.t ->
+    (unit, string) result
 
-val revoke_denomination :
-  t ->
-  denomination_hash ->
-  Bin_sig.MasterDenominationKeyRevocation.t ->
-  (unit, string) result
+  val revoke_denomination :
+    t ->
+    denomination_hash ->
+    Bin_sig.MasterDenominationKeyRevocation.t ->
+    (unit, string) result
+end
+
+module Make (_ : Pg.CONN) : S