diff --git a/src/keys.ml b/src/keys.ml
index c4b5f83b..1e505288 100644
--- a/src/keys.ml
+++ b/src/keys.ml
@@ -55,34 +55,36 @@ module Make (Conn : Pg.CONN) : S = struct
 
   let signkeys () : Signkey.t list result =
     let now = Timestamp.of_ptime @@ Ptime_clock.now () in
-    let* l = Pg.get_signkeys conn ~now |> unwrap_err_caqti in
-    let* () =
-      list_iter
-        (fun sk ->
-          match Sm_eddsa.find_key sk.Signkey.pub with
-          | None ->
-              Fmt.error
-                "signkeys found in database are missing from secmod, (unclean \
-                 database/secmod state?)"
-          | Some _ -> Ok ())
+    let+ l = Pg.get_signkeys conn ~now |> unwrap_err_caqti in
+    let missing_l, l =
+      List.partition
+        (fun sk -> Option.is_none @@ Sm_eddsa.find_key sk.Signkey.pub)
         l
     in
-    Ok l
+    match missing_l with
+    | [] -> l
+    | _ ->
+        Logs.warn (fun m ->
+            m
+              "signkeys found in database are missing from secmod, (unclean \
+               database/secmod state?)");
+        l
 
   let denominations () =
-    let* l = Pg.get_denominations conn () |> unwrap_err_caqti in
-    let* () =
-      list_iter
-        (fun dn ->
-          match Sm_rsa.find_key dn.Denomination.pub with
-          | None ->
-              Fmt.error
-                "denominations found in database are missing from secmod, \
-                 (unclean database/secmod state?)"
-          | Some _ -> Ok ())
+    let+ l = Pg.get_denominations conn () |> unwrap_err_caqti in
+    let missing_l, l =
+      List.partition
+        (fun dn -> Option.is_none @@ Sm_rsa.find_key dn.Denomination.pub)
         l
     in
-    Ok l
+    match missing_l with
+    | [] -> l
+    | _ ->
+        Logs.warn (fun m ->
+            m
+              "denominations found in database are missing from secmod, \
+               (unclean database/secmod state?)");
+        l
 
   (* TODO db-sm
      don't fail and just warn?