diff --git a/src/binary_formats.ml b/src/binary_formats.ml
index 84836609..203a6bef 100644
--- a/src/binary_formats.ml
+++ b/src/binary_formats.ml
@@ -448,7 +448,10 @@ module DenominationKeyAnnouncementPS = struct
     anchor_time: TimeAbsoluteNBO.t;
     duration_withdraw: TimeRelativeNBO.t;
   }
+
   (* TODO management *)
+  (* let bin = ... *)
+  let to_string _ = assert false
 end
 
 module SingleWithdrawRequestPS = struct
diff --git a/src/config.ml b/src/config.ml
index d9303674..a038758a 100644
--- a/src/config.ml
+++ b/src/config.ml
@@ -51,6 +51,7 @@ end
 let coin_kudo_1 =
   Types.Config_types.Coin.
     {
+      section_name= "kudo_1";
       value= amount "EUR:0.01";
       duration_withdraw= 999999;
       duration_spend= 999999;
@@ -64,5 +65,7 @@ let coin_kudo_1 =
       age_restricted= `NO;
     }
 
-let coin_kudo_2 = { coin_kudo_1 with value= amount "EUR:0.02" }
+let coin_kudo_2 =
+  { coin_kudo_1 with section_name= "kudo_2"; value= amount "EUR:0.02" }
+
 let coins = [ coin_kudo_1; coin_kudo_2 ]
diff --git a/src/json.ml b/src/json.ml
index f5f24e19..495bbd89 100644
--- a/src/json.ml
+++ b/src/json.ml
@@ -79,6 +79,7 @@ let amount_jsont =
 module EddsaPublicKey = struct
   open EddsaPublicKey
 
+  (* todo?: rewrite with of_of_string *)
   let jsont =
     let dec = Jsont.Base.dec_result of_string in
     let enc = Jsont.Base.enc to_string in
@@ -89,6 +90,15 @@ module EddsaSignature = struct
   let jsont = Jsont.string
 end
 
+module RsaPublicKey = struct
+  open RsaPublicKey
+
+  let jsont =
+    let dec = Jsont.Base.dec_result of_string in
+    let enc = Jsont.Base.enc to_string in
+    Jsont.Base.string (Jsont.Base.map ~kind:"RsaPublicKey" ~dec ~enc ())
+end
+
 module RsaDenominationKey = struct
   open RsaDenominationKey
 
@@ -98,7 +108,7 @@ module RsaDenominationKey = struct
     let rsa_pub v = v.rsa_pub in
     Jsont.Object.map ~kind:"RsaDenominationKey" make
     |> Jsont.Object.mem "age_mask" Jsont.int ~enc:age_mask
-    |> Jsont.Object.mem "rsa_pub" Jsont.string ~enc:rsa_pub
+    |> Jsont.Object.mem "rsa_pub" RsaPublicKey.jsont ~enc:rsa_pub
     |> Jsont.Object.finish
 end
 
diff --git a/src/management.ml b/src/management.ml
index 83654680..a03c49aa 100644
--- a/src/management.ml
+++ b/src/management.ml
@@ -1,3 +1,110 @@
+open Types
+
+(* TODO
+   - take secmod devices as param
+   - key stamp/time stuff
+   - hash stuff
+   ... *)
+
+let mk_denomination_key rsa_pub =
+  DenominationKey.Rsa RsaDenominationKey.{ age_mask= 0; rsa_pub }
+
+let mk_future_denom denom_secmod_sign_f (denom : Secmod_denom.rsa) =
+  let Types.Config_types.Coin.
+        {
+          section_name;
+          value;
+          duration_withdraw= _;
+          duration_spend= _;
+          duration_legal= _;
+          fee_withdraw;
+          fee_deposit;
+          fee_refresh;
+          fee_refund;
+          cipher= _;
+          rsa_keysize= _;
+          age_restricted= _;
+        } =
+    denom.coin
+  in
+  let denom_pub = mk_denomination_key denom.pub in
+  let stamp_x = Timestamp.Never in
+  let ps =
+    let h_denom_pub =
+      (* TODO hash *)
+      let v = denom.pub |> RsaPublicKey.to_string in
+      Binary_formats.DenominationHash.{ v= { v } }
+    in
+    let h_section_name =
+      (* TODO hash *)
+      let v = section_name in
+      Binary_formats.HashCode.{ v }
+    in
+    let anchor_time = Binary_formats.TimeAbsoluteNBO.{ v= 0_L } in
+    let duration_withdraw = Binary_formats.TimeRelativeNBO.{ v= 0_L } in
+    Binary_formats.DenominationKeyAnnouncementPS.
+      { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
+  in
+  let denom_secmod_sig =
+    ps
+    |>
+    (* TODO implement DenominationKeyAnnouncementPS.bin *)
+    Binary_formats.DenominationKeyAnnouncementPS.to_string
+    |>
+    (* TODO sig type *)
+    (* Signature by the denomination security module
+       not this denomination rsa signature *)
+    denom_secmod_sign_f
+  in
+  FutureDenom.
+    {
+      section_name;
+      value;
+      stamp_start= stamp_x;
+      stamp_expire_withdraw= stamp_x;
+      stamp_expire_deposit= stamp_x;
+      stamp_expire_legal= stamp_x;
+      denom_pub;
+      fee_withdraw;
+      fee_deposit;
+      fee_refresh;
+      fee_refund;
+      denom_secmod_sig;
+    }
+
+let mk_future_sign_key signkey_secmod_sign_f exchange_pub_key =
+  let stamp_start = Timestamp.Seconds 0.0 in
+  let stamp_expire = Timestamp.Never in
+  let stamp_end = Timestamp.Never in
+  let exchange_pub =
+    (* TODO
+       - I don't think its in crockford base 32 here
+         maybe SHA-512?
+         or maybe SHA-512 in crockford base 32
+         -> no, its not a hash here
+            need to change ugly binary_formats functor
+            to not mixup hashed values with others
+       - have a make function for wrapped HashCode structs
+         make it take the relevant type *)
+    let v = EddsaPublicKey.to_string exchange_pub_key in
+    Binary_formats.ExchangePublicKeyP.{ v= { v } }
+  in
+  let anchor_time = Binary_formats.TimeAbsoluteNBO.{ v= 0_L } in
+  let duration = Binary_formats.TimeRelativeNBO.{ v= 0_L } in
+  let signing_key_announcement_ps =
+    Binary_formats.SigningKeyAnnouncementPS.
+      { exchange_pub; anchor_time; duration }
+  in
+  let signkey_secmod_sig = signkey_secmod_sign_f signing_key_announcement_ps in
+  FutureSignKey.
+    {
+      key= exchange_pub_key;
+      stamp_start;
+      stamp_expire;
+      stamp_end;
+      signkey_secmod_sig;
+    }
+
 (* TODO *)
 let keys req _server _env =
   let open Vif.Response in
diff --git a/src/secmod_denom.ml b/src/secmod_denom.ml
index e95cd769..1e4f539c 100644
--- a/src/secmod_denom.ml
+++ b/src/secmod_denom.ml
@@ -1,7 +1,12 @@
 type rsa = {
   coin: Types.Config_types.Coin.t;
   pub: Types.RsaPublicKey.t;
-  sign: string -> string;
+  sign:
+    (* TODO sig type
+       should be
+       string -> RsaSignature.t *)
+    string ->
+    string;
 }
 
 let hash_pub _pub = "todo public key converted to Crockford Base32"
diff --git a/src/secmod_keys.ml b/src/secmod_keys.ml
index c452724b..809e65c4 100644
--- a/src/secmod_keys.ml
+++ b/src/secmod_keys.ml
@@ -1,6 +1,11 @@
 type t = {
   pub: Mirage_crypto_ec.Ed25519.pub;
-  sign: string -> string;
+  sign:
+    (* TODO sig type
+       should be
+       string -> EddsaSignature.t *)
+    string ->
+    string;
 }
 
 let make ~name =
diff --git a/src/types.ml b/src/types.ml
index 5d138e1e..6531c0d2 100644
--- a/src/types.ml
+++ b/src/types.ml
@@ -13,6 +13,8 @@ module Config_types = struct
 
   module Coin = struct
     type t = {
+      (* section_name: Name in the configuration file that defines this denomination *)
+      section_name: string;
       value: Amount.t;
       duration_withdraw: int;
       duration_spend: int;
@@ -82,6 +84,9 @@ module EddsaPublicKey = struct
     pub |> Mirage_crypto_ec.Ed25519.pub_to_octets |> B32.encode
 end
 
+(* TODO sig type
+   abstract type
+   same for RsaSignature *)
 module EddsaSignature = struct
   (* EdDSA signatures are transmitted as 64-bytes base32
      binary-encoded objects with just the R and S values (base32_ binary-only).
@@ -130,7 +135,7 @@ end
 module RsaDenominationKey = struct
   type t = {
     age_mask: int;
-    rsa_pub: string; (* Rsa.pub *)
+    rsa_pub: RsaPublicKey.t;
   }
 end
 
diff --git a/test/test.ml b/test/test.ml
index 2b54f1a2..7dbffb4c 100644
--- a/test/test.ml
+++ b/test/test.ml
@@ -18,6 +18,7 @@ let () =
   check_bad Timestamp.jsont {|{"t_s": "123456780"}|};
   check_bad Timestamp.jsont {|{"t_s": "agagou"}|};
 
+  (* TODO use a valid rsa_pub value *)
   check DenominationKey.jsont
     {|{"cipher": "RSA", "age_mask": 18, "rsa_pub": "agagouh"}|};
   check DenominationKey.jsont