diff --git a/src/secmod_signkey.ml b/src/secmod_signkey.ml
index 5a08b1b0..9e5e2b78 100644
--- a/src/secmod_signkey.ml
+++ b/src/secmod_signkey.ml
@@ -17,14 +17,15 @@ let get_signkeys t =
   Hashtbl.to_seq_values t.signkey_ht |> List.of_seq
 
 (* TODO *)
-let add_master_signatures _conn t l =
+let add_master_signatures conn t l =
   Miou.Mutex.protect t.lock @@ fun () ->
   l
-  |> Syntax.list_iter (fun Api.SignKeySignature.{ key= pub; master_sig } ->
+  |> list_iter (fun Api.SignKeySignature.{ key= pub; master_sig } ->
       match Hashtbl.find_opt t.signkey_ht pub with
       | None -> Error "secmod_signkey failure: public key not found."
       | Some signkey ->
           let signkey = { signkey with master_sig= Some master_sig } in
+          let* () = Pg.activate_signing_key conn signkey |> unwrap_err_caqti in
           Hashtbl.replace t.signkey_ht pub signkey;
           Ok ())
 
diff --git a/src/syntax.ml b/src/syntax.ml
index f354ca6c..c61aba15 100644
--- a/src/syntax.ml
+++ b/src/syntax.ml
@@ -4,6 +4,9 @@ let ( let+ ) o f = match o with Ok v -> Ok (f v) | Error _ as e -> e
 (* TODO use polymorphic variant for errors *)
 let unwrap_err_msg o = match o with Error (`Msg e) -> Error e | Ok v -> Ok v
 
+let unwrap_err_caqti o =
+  match o with Error err -> Fmt.error "%a" Caqti_error.pp err | Ok v -> Ok v
+
 let list_iter f l =
   let err = ref None in
   try