diff --git a/src/keys.ml b/src/keys.ml
index 5c3b917f..cdd34f42 100644
--- a/src/keys.ml
+++ b/src/keys.ml
@@ -288,44 +288,47 @@ module Make (Conn : Pg.CONN) = struct
   let find_future_denomination h_pub = Hashtbl.find_opt t.future_dn_ht h_pub
 
   let certify_future_signkey pub ~master_sig =
-    match
-      ( Hashtbl.find_opt t.future_sk_ht pub,
-        Hashtbl.find_opt t.future_sk_key_ht pub )
-    with
-    | None, _ | _, None ->
-        Error "Keys certify_future_signkey: future signkey not found."
-    | Some future_sk, Some priv -> (
-        match Hashtbl.find_opt t.sk_ht pub with
-        | Some _sk -> Error "Keys certify_future_signkey: already certified"
-        | None ->
-            let Api.FutureSignKey.
-                  {
-                    key;
-                    stamp_start;
-                    stamp_expire;
-                    stamp_end;
-                    signkey_secmod_sig= _;
-                  } =
-              future_sk
-            in
-            let sk =
-              Signkey.
-                {
-                  pub= key;
-                  stamp_start;
-                  stamp_expire;
-                  stamp_end;
-                  master_sig;
-                  revoked_sig= None;
-                }
-            in
-            Hashtbl.replace t.sk_ht pub sk;
-            Hashtbl.replace t.sk_key_ht pub priv;
-            Hashtbl.remove t.future_sk_ht pub;
-            Hashtbl.remove t.future_sk_key_ht pub;
+    let* priv, future_sk =
+      match
+        ( Hashtbl.find_opt t.future_sk_key_ht pub,
+          Hashtbl.find_opt t.future_sk_ht pub )
+      with
+      | None, None ->
+          Error "Keys certify_future_signkey: future signkey not found."
+      | None, _ | _, None -> Error "Keys invalid state"
+      | Some priv, Some future_sk -> Ok (priv, future_sk)
+    in
+    match Hashtbl.find_opt t.sk_ht pub with
+    | Some _sk -> Error "Keys certify_future_signkey: already certified"
+    | None ->
+        let Api.FutureSignKey.
+              {
+                key;
+                stamp_start;
+                stamp_expire;
+                stamp_end;
+                signkey_secmod_sig= _;
+              } =
+          future_sk
+        in
+        let sk =
+          Signkey.
+            {
+              pub= key;
+              stamp_start;
+              stamp_expire;
+              stamp_end;
+              master_sig;
+              revoked_sig= None;
+            }
+        in
+        Hashtbl.replace t.sk_ht pub sk;
+        Hashtbl.replace t.sk_key_ht pub priv;
+        Hashtbl.remove t.future_sk_ht pub;
+        Hashtbl.remove t.future_sk_key_ht pub;
 
-            let* () = Pg.insert_signkey (module Conn) sk |> unwrap_err_caqti in
-            Ok ())
+        let* () = Pg.insert_signkey (module Conn) sk |> unwrap_err_caqti in
+        Ok ()
 
   let certify_future_denomination h_pub ~master_sig =
     match