diff --git a/huhu.json b/huhu.json
new file mode 100644
index 00000000..0612f135
--- /dev/null
+++ b/huhu.json
@@ -0,0 +1 @@
+{"future_denoms":[{"section_name":"kudo_1","value":"EUR:0.01","stamp_start":{"t_s":1764325685.3722353},"stamp_expire_withdraw":{"t_s":1795861685.3722353},"stamp_expire_deposit":{"t_s":1795861685.3722353},"stamp_expire_legal":{"t_s":1795861685.3722353},"denom_pub":{"cipher":"RSA","age_mask":0,"rsa_pub":"00G000B1N5HMWEQ20FBHCJBPN1WYEQW2QWQAYXD4K7XYMHGE7EGK9ANSPW0G===="},"fee_withdraw":"EUR:0.00","fee_deposit":"EUR:0.00","fee_refresh":"EUR:0.00","fee_refund":"EUR:0.00","denom_secmod_sig":"15RVYAEDEDEXS59KGHTXRVXHE84R9G5GXS35HTM3TMJZJZJAHR5EXB059Y8476CKAQVZ29X24ZXYMD25JBME35B915J29HMNYWHS008="},{"section_name":"kudo_2","value":"EUR:0.02","stamp_start":{"t_s":1764325685.3959541},"stamp_expire_withdraw":{"t_s":1795861685.3959541},"stamp_expire_deposit":{"t_s":1795861685.3959541},"stamp_expire_legal":{"t_s":1795861685.3959541},"denom_pub":{"cipher":"RSA","age_mask":0,"rsa_pub":"00G000B28JDHE5FE65NEBJXY99MVEWNCK7841RDZ4DWGVDHTWQXZJ1J5CC0G===="},"fee_withdraw":"EUR:0.00","fee_deposit":"EUR:0.00","fee_refresh":"EUR:0.00","fee_refund":"EUR:0.00","denom_secmod_sig":"AW2B0MPQH49S4DA6Z2RFY20F729ARZSG6JFNW6TVP6XDKB68XEPTXE8KMKPMS8674ZACS1B9HSE0MGXQG2N5F9WE8XTF7NQQC9N583G="}],"future_signkeys":[{"key":"TVQD42VZXCJP3TAPMCZWNPW9W10KJQ6W9331PMDGVA8N2NCRZQHG====","stamp_start":{"t_s":1764325685.3721569},"stamp_expire":{"t_s":1795861685.3721569},"stamp_end":{"t_s":1795861685.3721569},"signkey_secmod_sig":"Q40CV90907G887AN21G88WAH6TTYXJHGGJHQW9S44GEYCBJCDW1XM50BWEAVDA4487KFSA3PEGGDHQE5ENEWX5A3VN57DBXZMJRQG38="}],"master_pub":"8MQF2XPWCKCW4199JFPE08X7Y9XAX21SF2HD8NZKXM3PY3CMCJ90====","denom_secmod_public_key":"0DPMY01Q43MD8PCGXZGAQ2HZDGJACZ2FJZA3MH9F4BRH7DBCCJ50====","signkey_secmod_public_key":"14WAGHPEC43G6TGQVFMZ4KMXZ5G1NN8ANNS7Y8YGVCKPWE57KQ8G===="}
\ No newline at end of file
diff --git a/tools/dune b/tools/dune
index 3375a448..3366e550 100644
--- a/tools/dune
+++ b/tools/dune
@@ -2,4 +2,4 @@
  (public_name offline)
  (name offline)
  (modules offline)
- (libraries cmdliner bos fmt mirage-crypto ptime mte))
+ (libraries cmdliner bos fmt mirage-crypto ptime mte vif))
diff --git a/tools/offline.ml b/tools/offline.ml
index 5d06c89b..fadf243b 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -1 +1,54 @@
-let () = Fmt.pr "hello~@."; ()
+let download ~base_url ~output_file =
+  let output_file = Fpath.v output_file in
+  let base_url = Uri.of_string base_url in
+  let uri = Uri.with_path base_url "/management/keys/" in
+  let uri = Uri.to_string uri in
+  Miou_unix.run @@ fun () ->
+  let rng = Mirage_crypto_rng_miou_unix.(initialize (module Pfortuna)) in
+  let finally () = Mirage_crypto_rng_miou_unix.kill rng in
+  Fun.protect ~finally @@ fun () ->
+  let fn _meta _req _resp buf = function
+    | Some str -> Buffer.add_string buf str; buf
+    | None -> buf
+  in
+  let prm =
+    Miou.async @@ fun () -> Httpcats.request ~fn ~uri (Buffer.create 0x1000)
+  in
+  match Miou.await prm with
+  | Error _exn -> Fmt.failwith "Download failure: exn@."
+  | Ok (Error err) ->
+      Fmt.failwith "Download failure: `%a`@." Httpcats.pp_error err
+  | Ok (Ok (_resp, buf)) -> (
+      let data = Buffer.to_bytes buf |> Bytes.to_string in
+      match Bos.OS.File.write output_file data with
+      | Error (`Msg err) -> Fmt.failwith "Download write failure: `%s`@." err
+      | Ok () -> ())
+
+(* CLI *)
+
+open Cmdliner
+open Cmdliner.Term.Syntax
+
+let output =
+  let doc = "File to save data to be signed." in
+  Arg.(
+    value & opt filepath "management_keys.json" & info [ "o"; "output" ] ~doc)
+
+let base_url =
+  let doc = "Base url of the exchange." in
+  Arg.(value & opt string "http://localhost:3434/" & info [ "base-url" ] ~doc)
+
+let download_cmd =
+  let doc = "Downloads /management/keys/" in
+  let man =
+    [ `S Manpage.s_description; `P "$(cmd) download /management/keys." ]
+  in
+  Cmd.make (Cmd.info "offline" ~version:"%%VERSION%%" ~doc ~man)
+  @@
+  let+ output_file = output and+ base_url = base_url in
+  download ~base_url ~output_file
+
+let main () =
+  try Cmd.eval download_cmd with Failure err -> Fmt.epr "%s@." err; exit 1
+
+let () = if !Sys.interactive then () else exit (main ())