diff --git a/src/keys.ml b/src/keys.ml
index 1cf3cc72..be6b003e 100644
--- a/src/keys.ml
+++ b/src/keys.ml
@@ -1,7 +1,7 @@
 (* TODO better error type *)
 type 'a result = ('a, string) Result.t
 
-module type S = Mod_intf.S
+module type S = Mod_intf.KEYS
 
 module Make (Conn : Pg.CONN) = struct
   let conn = (module Conn : Pg.CONN)
diff --git a/src/keys.mli b/src/keys.mli
index d2424c07..abf3e388 100644
--- a/src/keys.mli
+++ b/src/keys.mli
@@ -1,3 +1,3 @@
-module type S = Mod_intf.S
+module type S = Mod_intf.KEYS
 
 module Make (_ : Pg.CONN) : S
diff --git a/src/mod_intf.mli b/src/mod_intf.mli
index 70571160..cf0fb2f7 100644
--- a/src/mod_intf.mli
+++ b/src/mod_intf.mli
@@ -1,6 +1,6 @@
 type 'a result = ('a, string) Result.t
 
-module type S = sig
+module type KEYS = sig
   open Crypto
 
   val master_pub : eddsa_pub
diff --git a/src/secmod_eddsa.ml b/src/secmod_eddsa.ml
index 493c4c9c..cd6a182b 100644
--- a/src/secmod_eddsa.ml
+++ b/src/secmod_eddsa.ml
@@ -167,22 +167,14 @@ let t =
   | Error e -> Fmt.failwith "secmod_eddsa initialization failure: %s." e
   | Ok t -> t
 
-let sm_pub = t.sm_pub
-
-let keys () =
-  Hashtbl.to_seq_values t.ht
-  |> List.of_seq
-  |> List.map (fun { priv= _; pub; t1; t2 } -> (pub, t1, t2))
-
-let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s
-
 let find pub =
   Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found"
 
-let sign ~pub s =
-  let+ k = find pub in
-  let data = EddsaSignature.sign ~key:k.priv s in
-  data
+let add t1 t2 =
+  let priv, pub = EddsaPrivateKey.generate () in
+  let k = { priv; pub; t1; t2 } in
+  Hashtbl.replace t.ht k.pub k;
+  ()
 
 let delete pub =
   let* k = find pub in
@@ -195,11 +187,21 @@ let delete_outdated ~now =
   |> List.map (fun k -> k.pub)
   |> list_iter delete
 
-let add t1 t2 =
-  let priv, pub = EddsaPrivateKey.generate () in
-  let k = { priv; pub; t1; t2 } in
-  Hashtbl.replace t.ht k.pub k;
-  ()
+(* ---- *)
+
+let sm_pub = t.sm_pub
+
+let keys () =
+  Hashtbl.to_seq_values t.ht
+  |> List.of_seq
+  |> List.map (fun { priv= _; pub; t1; t2 } -> (pub, t1, t2))
+
+let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s
+
+let sign ~pub s =
+  let+ k = find pub in
+  let data = EddsaSignature.sign ~key:k.priv s in
+  data
 
 (* delete and replace *)
 let revoke pub =
@@ -209,7 +211,7 @@ let revoke pub =
 
 (* TODO
   - more checks
-  - sign: check time
+  - sign: check timestamps before signing
   - schedule tasks
   - !lock
 
diff --git a/src/secmod_rsa.ml b/src/secmod_rsa.ml
index bda3a0b0..a9e1de62 100644
--- a/src/secmod_rsa.ml
+++ b/src/secmod_rsa.ml
@@ -193,24 +193,9 @@ let t =
   | Error e -> Fmt.failwith "secmod_rsa initialization failure: %s." e
   | Ok t -> t
 
-let sm_pub = t.sm_pub
-
-let keys () =
-  Hashtbl.to_seq_values t.ht
-  |> List.of_seq
-  |> List.map (fun { section_name; priv= _; pub; t1; t2 } ->
-      (section_name, pub, t1, t2))
-
-let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s
-
 let find pub =
   Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found"
 
-let sign ~pub s =
-  let+ k = find pub in
-  let data = RsaSignature.sign ~key:k.priv s in
-  data
-
 let delete pub =
   let* k = find pub in
   Hashtbl.remove t.ht k.pub; delete_key_file k
@@ -228,7 +213,23 @@ let add section_name t1 t2 =
   Hashtbl.replace t.ht k.pub k;
   ()
 
-(* delete and replace *)
+(* ---- *)
+
+let sm_pub = t.sm_pub
+
+let keys () =
+  Hashtbl.to_seq_values t.ht
+  |> List.of_seq
+  |> List.map (fun { section_name; priv= _; pub; t1; t2 } ->
+      (section_name, pub, t1, t2))
+
+let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s
+
+let sign ~pub s =
+  let+ k = find pub in
+  let data = RsaSignature.sign ~key:k.priv s in
+  data
+
 let revoke pub =
   let* k = find pub in
   let* () = delete pub in