diff --git a/src/api_sig.ml b/src/api_sig.ml
index 642369a5..79715dbf 100644
--- a/src/api_sig.ml
+++ b/src/api_sig.ml
@@ -48,6 +48,7 @@ end) : sig
   (* Ok () on verification success *)
   val verify : key:Crypto.EddsaPublicKey.t -> t -> r -> (unit, string) result
   val jsont : t Jsont.t
+  val caqti : t Caqti_type.t
 end = struct
   open Crypto
 
@@ -64,6 +65,14 @@ end = struct
     | true -> Ok ()
 
   let jsont = EddsaSignature.jsont
+
+  let caqti : EddsaSignature.t Caqti_type.t =
+    let open Caqti_type in
+    let open EddsaSignature in
+    custom
+      ~encode:(fun v -> Ok (to_octets v))
+      ~decode:(fun s -> Ok (of_octets s))
+      octets
 end
 
 module DenominationKeyAnnouncementPS = struct
diff --git a/src/database.ml b/src/database.ml
index 7ee23436..2bc209bc 100644
--- a/src/database.ml
+++ b/src/database.ml
@@ -28,6 +28,5 @@ let test_activate req server _ =
   let db_conn = Vif.Server.device Devices.db_connection server in
   let secmod_signkey = Vif.Server.device Devices.secmod_signkey server in
   let sm_key = Secmod_signkey.get_sm_key secmod_signkey in
-  let sm_key = { sm_key with master_sig= dummy_master_sig } in
   let res = Pg.activate_signing_key db_conn sm_key in
   Result.fold ~ok:(on_ok req) ~error:(on_error req) res
diff --git a/src/management.ml b/src/management.ml
index 993024e7..45addc53 100644
--- a/src/management.ml
+++ b/src/management.ml
@@ -165,6 +165,12 @@ let verify_master_signatures ~sm_signkeys ~sm_denoms
 
 (* --- *)
 
+let update_master_signatures ~db_conn ~sm_signkey ~sm_denom:_
+    MasterSignatures.{ denom_sigs= _; signkey_sigs } =
+  Secmod_signkey.add_master_signatures db_conn sm_signkey signkey_sigs
+
+(* --- *)
+
 let respond_with_plain_text_error ?status e req =
   let open Vif.Response in
   let open Syntax in
@@ -198,6 +204,7 @@ let keys_get req server _env =
 let keys_post_jsont = MasterSignatures.jsont
 
 let keys_post req server _env =
+  let db_conn = Vif.Server.device Devices.db_connection server in
   let sm_signkey = Vif.Server.device Devices.secmod_signkey server in
   let sm_denom = Vif.Server.device Devices.secmod_denom server in
   let res =
@@ -214,7 +221,9 @@ let keys_post req server _env =
       let sm_signkeys = Secmod_signkey.get_signkeys sm_signkey in
       verify_master_signatures ~sm_signkeys ~sm_denoms master_signatures
     in
-    (* TODO let* () = update_master_signatures () in*)
+    let* () =
+      update_master_signatures ~db_conn ~sm_signkey ~sm_denom master_signatures
+    in
     Ok ""
   in
   respond_with_res res req
diff --git a/src/pg.ml b/src/pg.ml
index b6f6264e..57bfec70 100644
--- a/src/pg.ml
+++ b/src/pg.ml
@@ -92,7 +92,8 @@ let lookup_signing_key =
 
 let activate_signing_key =
   let insert_signkey =
-    Caqti_type.(t5 eddsa_public time time time eddsa_signature ->. unit)
+    let master_sig = Api_sig.ExchangeSigningKeyValidityPS.caqti in
+    Caqti_type.(t5 eddsa_public time time time master_sig ->. unit)
       "INSERT INTO exchange_sign_keys (exchange_pub, valid_from, expire_sign, \
        expire_legal, master_sig) VALUES ($1, $2, $3, $4, $5)"
   in
diff --git a/src/secmod_signkey.ml b/src/secmod_signkey.ml
index d1a6067c..5a08b1b0 100644
--- a/src/secmod_signkey.ml
+++ b/src/secmod_signkey.ml
@@ -17,11 +17,16 @@ let get_signkeys t =
   Hashtbl.to_seq_values t.signkey_ht |> List.of_seq
 
 (* TODO *)
-let update_signkeys _conn t signkeys =
+let add_master_signatures _conn t l =
   Miou.Mutex.protect t.lock @@ fun () ->
-  List.iter
-    (fun signkey -> Hashtbl.replace t.signkey_ht signkey.Signkey.pub signkey)
-    signkeys
+  l
+  |> Syntax.list_iter (fun Api.SignKeySignature.{ key= pub; master_sig } ->
+      match Hashtbl.find_opt t.signkey_ht pub with
+      | None -> Error "secmod_signkey failure: public key not found."
+      | Some signkey ->
+          let signkey = { signkey with master_sig= Some master_sig } in
+          Hashtbl.replace t.signkey_ht pub signkey;
+          Ok ())
 
 let dir = Fpath.(v "data" / "secmod_signkey")
 
diff --git a/src/secmod_signkey.mli b/src/secmod_signkey.mli
index a80b07de..70afb7f6 100644
--- a/src/secmod_signkey.mli
+++ b/src/secmod_signkey.mli
@@ -2,5 +2,8 @@ type t
 
 val get_sm_key : t -> Signkey.t
 val get_signkeys : t -> Signkey.t list
-val update_signkeys : (module Pg.CONN) -> t -> Signkey.t list -> unit
+
+val add_master_signatures :
+  (module Pg.CONN) -> t -> Api.SignKeySignature.t list -> (unit, string) result
+
 val init : (module Pg.CONN) -> t
diff --git a/src/signkey.ml b/src/signkey.ml
index 3c59043e..fbb29d72 100644
--- a/src/signkey.ml
+++ b/src/signkey.ml
@@ -8,8 +8,7 @@ type t = {
   stamp_start: Timestamp.t;
   stamp_expire: Timestamp.t;
   stamp_end: Timestamp.t;
-  (* signature of this key by offline master key *)
-  master_sig: EddsaSignature.t option;
+  master_sig: Api_sig.ExchangeSigningKeyValidityPS.t option;
 }
 
 let make () =