JJ: Description from the destination commit:

wip secmod

JJ: Description from source commit:
better secmod

tools/offline_impl.ml

@@ -1,11 +1,19 @@
 open Syntax
+open Crypto
 open Hash
 
 module Future_keys = struct
-  open Crypto
   open Api
 
-  let verify =
+  let verify offline_master_public_key
+      FutureKeysResponse.
+        {
+          future_denoms;
+          future_signkeys;
+          master_pub;
+          denom_secmod_public_key;
+          signkey_secmod_public_key;
+        } =
     let verify_future_denom ~sm_denom_pub
         FutureDenom.
           {
@@ -31,9 +39,7 @@ module Future_keys = struct
         Timestamp.diff stamp_start stamp_expire_withdraw
       in
       let open Signatures.DenominationKeyAnnouncement in
-      verify_f
-        ~f:(EddsaSignature.verify ~key:sm_denom_pub)
-        denom_secmod_sig
+      verify sm_denom_pub denom_secmod_sig
         { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
     in
     let verify_future_signkey ~sm_signkey_pub
@@ -43,42 +49,38 @@ module Future_keys = struct
       let anchor_time = stamp_start in
       let duration = Timestamp.diff stamp_start stamp_expire in
       let open Signatures.SigningKeyAnnouncement in
-      verify_f
-        ~f:(EddsaSignature.verify ~key:sm_signkey_pub)
-        signkey_secmod_sig
+      verify sm_signkey_pub signkey_secmod_sig
         { exchange_pub; anchor_time; duration }
     in
-    fun our_master_public_key
+    let* () =
+      match master_pub = offline_master_public_key with
+      | false ->
+          Fmt.error
+            "master public key of the future key response does not match ours"
+      | true -> Ok ()
+    in
+    let* () =
+      list_iter
+        (verify_future_denom ~sm_denom_pub:denom_secmod_public_key)
+        future_denoms
+    in
+    let* () =
+      list_iter
+        (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key)
+        future_signkeys
+    in
+    Ok ()
+
+  let make ~master_key
       FutureKeysResponse.
         {
           future_denoms;
           future_signkeys;
-          master_pub;
-          denom_secmod_public_key;
-          signkey_secmod_public_key;
-        }
-    ->
-      let* () =
-        match master_pub = our_master_public_key with
-        | false ->
-            Fmt.error
-              "master public key of the future key response does not match ours"
-        | true -> Ok ()
-      in
-      let* () =
-        list_iter
-          (verify_future_denom ~sm_denom_pub:denom_secmod_public_key)
-          future_denoms
-      in
-      let* () =
-        list_iter
-          (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key)
-          future_signkeys
-      in
-      Ok ()
-
-  let make =
-    let denom_signature ~master_key
+          master_pub= _;
+          denom_secmod_public_key= _;
+          signkey_secmod_public_key= _;
+        } =
+    let denom_signature
         FutureDenom.
           {
             section_name= _;
@@ -99,8 +101,8 @@ module Future_keys = struct
       let master_sig =
         let open Signatures.DenominationKeyValidity in
         let master = EddsaPrivateKey.(pub_of_priv master_key) in
-        sign_f
-          ~f:(EddsaSignature.sign ~key:master_key)
+        signf
+          (EddsaSignature.sign ~key:master_key)
           {
             master;
             start= stamp_start;
@@ -117,13 +119,13 @@ module Future_keys = struct
       in
       DenomSignature.{ h_denom_pub; master_sig }
     in
-    let signkey_signature ~master_key
+    let signkey_signature
         FutureSignKey.
           { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
       let master_sig =
         let open Signatures.ExchangeSigningKeyValidity in
-        sign_f
-          ~f:(EddsaSignature.sign ~key:master_key)
+        signf
+          (EddsaSignature.sign ~key:master_key)
           {
             start= stamp_start;
             expire= stamp_expire;
@@ -133,21 +135,9 @@ module Future_keys = struct
       in
       SignKeySignature.{ key; master_sig }
     in
-    fun ~master_key
-      FutureKeysResponse.
-        {
-          future_denoms;
-          future_signkeys;
-          master_pub= _;
-          denom_secmod_public_key= _;
-          signkey_secmod_public_key= _;
-        }
-    ->
-      let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
-      let signkey_sigs =
-        List.map (signkey_signature ~master_key) future_signkeys
-      in
-      MasterSignatures.{ denom_sigs; signkey_sigs }
+    let denom_sigs = List.map denom_signature future_denoms in
+    let signkey_sigs = List.map signkey_signature future_signkeys in
+    MasterSignatures.{ denom_sigs; signkey_sigs }
 end
 
 (* -- *)
@@ -159,7 +149,7 @@ let write_file fname content =
 
 let read_master_key_file filename =
   let* master_key = read_file filename in
-  Crypto.EddsaPrivateKey.of_octets master_key
+  EddsaPrivateKey.of_octets master_key
 
 let download ~output ~url =
   let open Bos in
@@ -201,7 +191,6 @@ let setup ~output ~output_pubkey =
   Ok ()
 
 let sign ~master_key ~input ~output =
-  let open Crypto in
   let* master_key = read_master_key_file master_key in
   let* input = read_file input in
   let master_pub = EddsaPrivateKey.pub_of_priv master_key in
@@ -218,7 +207,7 @@ let revoke_denom ~output ~master_key ~h_denom =
   let denom_revoke =
     let master_sig =
       let open Signatures.MasterDenominationKeyRevocation in
-      sign_f ~f:(Crypto.EddsaSignature.sign ~key) { h_denom_pub }
+      signf (EddsaSignature.sign ~key) { h_denom_pub }
     in
     Api.DenomRevocationSignature.{ master_sig }
   in
@@ -231,7 +220,7 @@ let revoke_signkey ~output ~master_key ~signkey =
   let signkey_revoke =
     let master_sig =
       let open Signatures.MasterSigningKeyRevocation in
-      sign_f ~f:(Crypto.EddsaSignature.sign ~key) { exchange_pub= signkey }
+      signf (EddsaSignature.sign ~key) { exchange_pub= signkey }
     in
     Api.SignkeyRevocationSignature.{ master_sig }
   in
@@ -242,7 +231,6 @@ let revoke_signkey ~output ~master_key ~signkey =
 let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
     ~account_fee ~purse_fee ~history_expiration ~purse_account_limit
     ~purse_timeout =
-  let open Crypto in
   let* key = read_master_key_file master_key in
   let* purse_account_limit =
     match
@@ -254,7 +242,7 @@ let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
   in
   let master_sig =
     let open Signatures.GlobalFees in
-    sign_f ~f:(EddsaSignature.sign ~key)
+    signf (EddsaSignature.sign ~key)
       {
         start_date;
         end_date;
@@ -286,11 +274,10 @@ let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
 
 let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub
     ~validity_start =
-  let open Crypto in
   let* key = read_master_key_file master_key in
   let master_sig =
     let open Signatures.MasterAddAuditor in
-    sign_f ~f:(EddsaSignature.sign ~key)
+    signf (EddsaSignature.sign ~key)
       {
         start_date= validity_start;
         auditor_pub;
@@ -306,11 +293,10 @@ let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub
   Ok ()
 
 let disable_auditor ~output ~master_key ~auditor_pub ~validity_end =
-  let open Crypto in
   let* key = read_master_key_file master_key in
   let master_sig =
     let open Signatures.MasterDelAuditor in
-    sign_f ~f:(EddsaSignature.sign ~key) { end_date= validity_end; auditor_pub }
+    signf (EddsaSignature.sign ~key) { end_date= validity_end; auditor_pub }
   in
   let v = Api.AuditorTeardownMessage.{ master_sig; validity_end } in
   let* s = Api.encode Api.AuditorTeardownMessage.jsont v in
@@ -319,11 +305,10 @@ let disable_auditor ~output ~master_key ~auditor_pub ~validity_end =
 
 let wire_fee ~output ~master_key ~wire_method ~fee_start ~fee_end ~closing_fee
     ~wire_fee =
-  let open Crypto in
   let* key = read_master_key_file master_key in
   let master_sig_wire =
     let open Signatures.MasterWireFee in
-    sign_f ~f:(EddsaSignature.sign ~key)
+    signf (EddsaSignature.sign ~key)
       {
         h_wire_method= Hash.Cstring.H64.hash wire_method;
         start_date= fee_start;
@@ -349,11 +334,10 @@ let wire_fee ~output ~master_key ~wire_method ~fee_start ~fee_end ~closing_fee
 
 let drain ~output ~master_key ~debit_account_section ~credit_payto_uri ~wtid
     ~date ~amount =
-  let open Crypto in
   let* key = read_master_key_file master_key in
   let master_sig =
     let open Signatures.MasterDrainProfit in
-    sign_f ~f:(EddsaSignature.sign ~key)
+    signf (EddsaSignature.sign ~key)
       {
         wtid;
         date;