diff --git a/src/binary_formats.ml b/src/binary_formats.ml
index 9541553c..4edb28a7 100644
--- a/src/binary_formats.ml
+++ b/src/binary_formats.ml
@@ -38,9 +38,56 @@
      ? only for "HashCode" and "ShortHashCode"
  *)
 
+module Taler_signatures = Include.Taler_signatures
+
 let int32_size = 4
 let int64_size = 8
 
+module RsaPublicKey = struct
+  (* https://www.gnupg.org/documentation/manuals/gcrypt/MPI-formats.html
+     format: { uint16_be: n size; uint16_be: e size; n; e}
+
+    integer in big-endian format (MSB first)
+    leading zeroes are stripped unless they are required to keep a value positive
+    no 0-termination *)
+
+  let rev_string len s = String.init len (fun i -> s.[len - 1 - i])
+
+  (* todo: need to strip leading zeros or something? *)
+  (* reverse bytes because Z.of_bits reads bytes in little endian *)
+  let z_of_bits_be src pos len =
+    String.sub src pos len |> rev_string len |> Z.of_bits
+
+  let to_octets ({ n; e } : Mirage_crypto_pk.Rsa.pub) =
+    let n_len = Z.size n in
+    let e_len = Z.size e in
+    let len = 4 + n_len + e_len in
+    let b = Bytes.make len '\x00' in
+    Bytes.set_uint16_be b 0 n_len;
+    Bytes.set_uint16_be b 2 e_len;
+    let n = Z.to_bits n |> rev_string n_len in
+    let e = Z.to_bits e |> rev_string e_len in
+    Bytes.blit_string n 0 b 4 n_len;
+    Bytes.blit_string e 0 b (4 + n_len) e_len;
+    Bytes.unsafe_to_string b
+
+  let of_octets =
+    let check = function
+      | false -> Error "RsaPublicKey.of_octets: invalid data"
+      | true -> Ok ()
+    in
+    fun s ->
+      let open Syntax in
+      let len = String.length s in
+      let* () = check (len >= 4) in
+      let n_len = String.get_uint16_be s 0 in
+      let e_len = String.get_uint16_be s 2 in
+      let* () = check (len = n_len + e_len + 4) in
+      let n = z_of_bits_be s 4 n_len in
+      let e = z_of_bits_be s (4 + n_len) e_len in
+      Mirage_crypto_pk.Rsa.pub ~n ~e |> unwrap_err_msg
+end
+
 (* -- Time -- *)
 
 (* microseconds since the UNIX Epoch
@@ -238,58 +285,9 @@ module UTIL = struct
 end
 
 include UTIL
-module Taler_signatures = Include.Taler_signatures
 
 (* -- Cryptographic primitives -- *)
 
-module RsaPublicKey = struct
-  (* https://www.gnupg.org/documentation/manuals/gcrypt/MPI-formats.html
-     format:
-      - uint16_be: n size
-      - uint16_be: e size
-      - n
-      - e
-
-    integer in big-endian format (MSB first).
-    Leading zeroes are stripped unless they are required to keep a value positive. *)
-
-  let rev_string len s = String.init len (fun i -> s.[len - 1 - i])
-
-  (* todo: need to strip leading zeros or something? *)
-  (* reverse bytes because Z.of_bits reads little endian *)
-  let z_of_bits_be src pos len =
-    String.sub src pos len |> rev_string len |> Z.of_bits
-
-  let to_octets ({ n; e } : Mirage_crypto_pk.Rsa.pub) =
-    let n_len = Z.size n in
-    let e_len = Z.size e in
-    let len = 4 + n_len + e_len in
-    let b = Bytes.make len '\x00' in
-    Bytes.set_uint16_be b 0 n_len;
-    Bytes.set_uint16_be b 2 e_len;
-    let n = Z.to_bits n |> rev_string n_len in
-    let e = Z.to_bits e |> rev_string e_len in
-    Bytes.blit_string n 0 b 4 n_len;
-    Bytes.blit_string e 0 b (4 + n_len) e_len;
-    Bytes.unsafe_to_string b
-
-  let of_octets =
-    let check = function
-      | false -> Error "RsaPublicKey.of_octets: invalid data"
-      | true -> Ok ()
-    in
-    fun s ->
-      let open Syntax in
-      let len = String.length s in
-      let* () = check (len >= 4) in
-      let n_len = String.get_uint16_be s 0 in
-      let e_len = String.get_uint16_be s 2 in
-      let* () = check (len = n_len + e_len + 4) in
-      let n = z_of_bits_be s 4 n_len in
-      let e = z_of_bits_be s (4 + n_len) e_len in
-      Mirage_crypto_pk.Rsa.pub ~n ~e |> unwrap_err_msg
-end
-
 module DenominationHash = MK_SRC_HASH_32 (struct
   type src = Mirage_crypto_pk.Rsa.pub