diff --git a/src/http_keys.ml b/src/http_keys.ml
index dd924c90..9c9957d7 100644
--- a/src/http_keys.ml
+++ b/src/http_keys.ml
@@ -194,7 +194,9 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date =
   let* global_fees =
     Pg.get_global_fees db_conn ~start_date:Timestamp.epoch |> unwrap_err_caqti
   in
-  let auditors = (* TODO *) [] in
+  let auditors =
+    (* TODO /management/auditors + /auditors/$AUDITOR_PUB/$H_DENOM_PUB *) []
+  in
   let extensions = None in
   let extensions_sig = None in
   Ok
diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml
index cd4ce9db..48f4cbbe 100644
--- a/tools/offline_impl.ml
+++ b/tools/offline_impl.ml
@@ -52,7 +52,7 @@ let sign ~master_key ~input ~output =
     Offline_sig.verify_future_keys_response master_pub future_keys_response
   in
   let master_signatures =
-    Offline_sig.make_master_signatures ~master_key future_keys_response
+    Offline_sig.mk_future_keys ~master_key future_keys_response
   in
   let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
   let* () = write_file output s in
@@ -61,18 +61,29 @@ let sign ~master_key ~input ~output =
 let revoke_denom ~output ~master_key ~h_denom =
   let* key = read_master_key_file master_key in
   let* h_denom = B32.decode h_denom in
-  let h_denom = Bin_type.DenominationHash.of_octets h_denom in
-  let denom_revoke = Offline_sig.mk_denom_revoke ~key h_denom in
+  let h_denom_pub = Bin_type.DenominationHash.of_octets h_denom in
+  let denom_revoke =
+    let master_sig =
+      let open Bin_sig.MasterDenominationKeyRevocation in
+      sign_f ~f:(Crypto.EddsaSignature.sign ~key) { h_denom_pub }
+    in
+    Api.DenomRevocationSignature.{ master_sig }
+  in
   let* s = Api.encode Api.DenomRevocationSignature.jsont denom_revoke in
   let* () = write_file output s in
   Ok ()
 
 let revoke_signkey ~output ~master_key ~signkey =
-  let open Crypto in
   let* key = read_master_key_file master_key in
-  let* signkey = EddsaPublicKey.of_b32 signkey in
-  let v = Offline_sig.mk_signkey_revoke ~key signkey in
-  let* s = Api.encode Api.SignkeyRevocationSignature.jsont v in
+  let* exchange_pub = Crypto.EddsaPublicKey.of_b32 signkey in
+  let signkey_revoke =
+    let master_sig =
+      let open Bin_sig.MasterSigningKeyRevocation in
+      sign_f ~f:(Crypto.EddsaSignature.sign ~key) { exchange_pub }
+    in
+    Api.SignkeyRevocationSignature.{ master_sig }
+  in
+  let* s = Api.encode Api.SignkeyRevocationSignature.jsont signkey_revoke in
   let* () = write_file output s in
   Ok ()
 
diff --git a/tools/offline_sig.ml b/tools/offline_sig.ml
index eaeda431..0c07ce22 100644
--- a/tools/offline_sig.ml
+++ b/tools/offline_sig.ml
@@ -2,116 +2,49 @@ open Crypto
 open Bin_type
 open Api
 
-let denom_signature ~master_key
-    FutureDenom.
-      {
-        section_name= _;
-        value;
-        stamp_start;
-        stamp_expire_withdraw;
-        stamp_expire_deposit;
-        stamp_expire_legal;
-        denom_pub;
-        fee_withdraw;
-        fee_deposit;
-        fee_refresh;
-        fee_refund= _;
-        denom_secmod_sig= _;
-      } =
-  let octets = DenominationKey.to_octets denom_pub in
-  let h_denom_pub = DenominationHash.hash octets in
-  let master_sig =
-    let open Bin_sig.DenominationKeyValidity in
-    let master = EddsaPrivateKey.(pub_of_priv master_key) in
-    sign_f
-      ~f:(EddsaSignature.sign ~key:master_key)
-      {
-        master;
-        start= stamp_start;
-        expire_withdraw= stamp_expire_withdraw;
-        expire_spend= stamp_expire_deposit;
-        expire_legal= stamp_expire_legal;
-        value;
-        fee_withdraw;
-        fee_deposit;
-        fee_refresh;
-        denom_hash= h_denom_pub;
-      }
+let verify_future_keys_response =
+  let verify_future_denom ~sm_denom_pub
+      FutureDenom.
+        {
+          section_name;
+          value= _;
+          stamp_start;
+          stamp_expire_withdraw;
+          stamp_expire_deposit= _;
+          stamp_expire_legal= _;
+          denom_pub;
+          fee_withdraw= _;
+          fee_deposit= _;
+          fee_refresh= _;
+          fee_refund= _;
+          denom_secmod_sig;
+        } =
+    let h_denom_pub =
+      DenominationHash.hash (DenominationKey.to_octets denom_pub)
+    in
+    let h_section_name = Hash_64_cstr.hash section_name in
+    let anchor_time = stamp_start in
+    let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in
+    let open Bin_sig.DenominationKeyAnnouncement in
+    verify_f
+      ~f:(EddsaSignature.verify ~key:sm_denom_pub)
+      denom_secmod_sig
+      { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
   in
-  DenomSignature.{ h_denom_pub; master_sig }
-
-let signkey_signature ~master_key
-    FutureSignKey.
-      { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
-  let master_sig =
-    let open Bin_sig.ExchangeSigningKeyValidity in
-    sign_f
-      ~f:(EddsaSignature.sign ~key:master_key)
-      {
-        start= stamp_start;
-        expire= stamp_expire;
-        end_= stamp_end;
-        signkey_pub= key;
-      }
+  let verify_future_signkey ~sm_signkey_pub
+      FutureSignKey.
+        { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } =
+    let exchange_pub = key in
+    let anchor_time = stamp_start in
+    let duration = Timestamp.diff stamp_start stamp_expire in
+    let open Bin_sig.SigningKeyAnnouncement in
+    verify_f
+      ~f:(EddsaSignature.verify ~key:sm_signkey_pub)
+      signkey_secmod_sig
+      { exchange_pub; anchor_time; duration }
   in
-  SignKeySignature.{ key; master_sig }
 
-let make_master_signatures ~master_key
-    FutureKeysResponse.
-      {
-        future_denoms;
-        future_signkeys;
-        master_pub= _;
-        denom_secmod_public_key= _;
-        signkey_secmod_public_key= _;
-      } =
-  let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
-  let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in
-  MasterSignatures.{ denom_sigs; signkey_sigs }
-
-(* - ** - *)
-
-let verify_future_signkey ~sm_signkey_pub
-    FutureSignKey.
-      { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } =
-  let exchange_pub = key in
-  let anchor_time = stamp_start in
-  let duration = Timestamp.diff stamp_start stamp_expire in
-  let open Bin_sig.SigningKeyAnnouncement in
-  verify_f
-    ~f:(EddsaSignature.verify ~key:sm_signkey_pub)
-    signkey_secmod_sig
-    { exchange_pub; anchor_time; duration }
-
-let verify_future_denom ~sm_denom_pub
-    FutureDenom.
-      {
-        section_name;
-        value= _;
-        stamp_start;
-        stamp_expire_withdraw;
-        stamp_expire_deposit= _;
-        stamp_expire_legal= _;
-        denom_pub;
-        fee_withdraw= _;
-        fee_deposit= _;
-        fee_refresh= _;
-        fee_refund= _;
-        denom_secmod_sig;
-      } =
-  let h_denom_pub =
-    DenominationHash.hash (DenominationKey.to_octets denom_pub)
-  in
-  let h_section_name = Hash_64_cstr.hash section_name in
-  let anchor_time = stamp_start in
-  let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in
-  let open Bin_sig.DenominationKeyAnnouncement in
-  verify_f
-    ~f:(EddsaSignature.verify ~key:sm_denom_pub)
-    denom_secmod_sig
-    { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
-
-let verify_future_keys_response our_master_public_key
+  fun our_master_public_key
     FutureKeysResponse.
       {
         future_denoms;
@@ -119,37 +52,96 @@ let verify_future_keys_response our_master_public_key
         master_pub;
         denom_secmod_public_key;
         signkey_secmod_public_key;
-      } =
-  let open Syntax in
-  let* () =
-    match master_pub = our_master_public_key with
-    | false ->
-        Fmt.error
-          "master public key of the future key response does not match ours"
-    | true -> Ok ()
-  in
-  let* () =
-    list_iter
-      (verify_future_denom ~sm_denom_pub:denom_secmod_public_key)
-      future_denoms
-  in
-  let* () =
-    list_iter
-      (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key)
-      future_signkeys
-  in
-  Ok ()
+      }
+  ->
+    let open Syntax in
+    let* () =
+      match master_pub = our_master_public_key with
+      | false ->
+          Fmt.error
+            "master public key of the future key response does not match ours"
+      | true -> Ok ()
+    in
+    let* () =
+      list_iter
+        (verify_future_denom ~sm_denom_pub:denom_secmod_public_key)
+        future_denoms
+    in
+    let* () =
+      list_iter
+        (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key)
+        future_signkeys
+    in
+    Ok ()
 
-let mk_denom_revoke ~key h_denom_pub =
-  let master_sig =
-    let open Bin_sig.MasterDenominationKeyRevocation in
-    sign_f ~f:(EddsaSignature.sign ~key) { h_denom_pub }
+let mk_future_keys =
+  let denom_signature ~master_key
+      FutureDenom.
+        {
+          section_name= _;
+          value;
+          stamp_start;
+          stamp_expire_withdraw;
+          stamp_expire_deposit;
+          stamp_expire_legal;
+          denom_pub;
+          fee_withdraw;
+          fee_deposit;
+          fee_refresh;
+          fee_refund= _;
+          denom_secmod_sig= _;
+        } =
+    let octets = DenominationKey.to_octets denom_pub in
+    let h_denom_pub = DenominationHash.hash octets in
+    let master_sig =
+      let open Bin_sig.DenominationKeyValidity in
+      let master = EddsaPrivateKey.(pub_of_priv master_key) in
+      sign_f
+        ~f:(EddsaSignature.sign ~key:master_key)
+        {
+          master;
+          start= stamp_start;
+          expire_withdraw= stamp_expire_withdraw;
+          expire_spend= stamp_expire_deposit;
+          expire_legal= stamp_expire_legal;
+          value;
+          fee_withdraw;
+          fee_deposit;
+          fee_refresh;
+          denom_hash= h_denom_pub;
+        }
+    in
+    DenomSignature.{ h_denom_pub; master_sig }
+  in
+  let signkey_signature ~master_key
+      FutureSignKey.
+        { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
+    let master_sig =
+      let open Bin_sig.ExchangeSigningKeyValidity in
+      sign_f
+        ~f:(EddsaSignature.sign ~key:master_key)
+        {
+          start= stamp_start;
+          expire= stamp_expire;
+          end_= stamp_end;
+          signkey_pub= key;
+        }
+    in
+    SignKeySignature.{ key; master_sig }
   in
-  DenomRevocationSignature.{ master_sig }
 
-let mk_signkey_revoke ~key exchange_pub =
-  let master_sig =
-    let open Bin_sig.MasterSigningKeyRevocation in
-    sign_f ~f:(EddsaSignature.sign ~key) { exchange_pub }
-  in
-  SignkeyRevocationSignature.{ master_sig }
+  fun ~master_key
+    FutureKeysResponse.
+      {
+        future_denoms;
+        future_signkeys;
+        master_pub= _;
+        denom_secmod_public_key= _;
+        signkey_secmod_public_key= _;
+      }
+  ->
+    let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
+    let signkey_sigs =
+      List.map (signkey_signature ~master_key) future_signkeys
+    in
+    MasterSignatures.{ denom_sigs; signkey_sigs }