diff --git a/src/http_info.ml b/src/http_info.ml
index 5c8fa438..d0453d6b 100644
--- a/src/http_info.ml
+++ b/src/http_info.ml
@@ -173,7 +173,7 @@ let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date =
       |> Hash.H64.hash
     in
     let open Signatures.ExchangeKeySet in
-    sign_f ~f:(Keys.sign ~pub:exchange_pub) R.{ list_issue_date; hc }
+    signf (Keys.sign ~pub:exchange_pub) R.{ list_issue_date; hc }
   in
 
   let recoup = (* TODO /recoup *) [] in
diff --git a/src/http_management.ml b/src/http_management.ml
index 3c72997b..2be6cd6c 100644
--- a/src/http_management.ml
+++ b/src/http_management.ml
@@ -51,7 +51,7 @@ module Keys_post = struct
         denom_hash;
       }
     in
-    verify_f ~f:(Crypto.EddsaSignature.verify ~key:Keys.master_pub) master_sig r
+    verify Keys.master_pub master_sig r
 
   let verify_denom_sigs (module Keys : Keys.S) denom_sigs =
     let* fdn_l = Keys.future_denominations () in
@@ -86,7 +86,7 @@ module Keys_post = struct
         signkey_pub= key;
       }
     in
-    verify_f ~f:(Crypto.EddsaSignature.verify ~key:Keys.master_pub) master_sig r
+    verify Keys.master_pub master_sig r
 
   let verify_signkey_sigs (module Keys : Keys.S) signkey_sigs =
     let* fsk_l = Keys.future_signkeys () in
@@ -137,9 +137,7 @@ module Denom_revoke = struct
   let verify (module Keys : Keys.S) h_denom_pub
       DenomRevocationSignature.{ master_sig } =
     let open Signatures.MasterDenominationKeyRevocation in
-    verify_f
-      ~f:(Crypto.EddsaSignature.verify ~key:Keys.master_pub)
-      master_sig { h_denom_pub }
+    verify Keys.master_pub master_sig { h_denom_pub }
 
   let do_ (module Keys : Keys.S) h_denom_pub
       DenomRevocationSignature.{ master_sig } =
@@ -165,7 +163,7 @@ module Signkey_revoke = struct
   let verify (module Keys : Keys.S) exchange_pub
       SignkeyRevocationSignature.{ master_sig } =
     let open Signatures.MasterSigningKeyRevocation in
-    verify_f ~f:Keys.verify_with_master_key master_sig { exchange_pub }
+    verify Keys.master_pub master_sig { exchange_pub }
 
   let do_ (module Keys : Keys.S) exchange_pub
       SignkeyRevocationSignature.{ master_sig } =
@@ -198,7 +196,7 @@ module Auditors = struct
           validity_start;
         } =
     let open Signatures.MasterAddAuditor in
-    verify_f ~f:Keys.verify_with_master_key master_sig
+    verify Keys.master_pub master_sig
       {
         start_date= validity_start;
         auditor_pub;
@@ -245,8 +243,7 @@ module Auditors_disable = struct
   let verify (module Keys : Keys.S) auditor_pub
       AuditorTeardownMessage.{ master_sig; validity_end } =
     let open Signatures.MasterDelAuditor in
-    verify_f ~f:Keys.verify_with_master_key master_sig
-      { end_date= validity_end; auditor_pub }
+    verify Keys.master_pub master_sig { end_date= validity_end; auditor_pub }
 
   let do_ ~db_conn auditor_pub
       AuditorTeardownMessage.{ master_sig= _; validity_end } =
@@ -294,7 +291,7 @@ module Wire_fee = struct
           wire_fee;
         } =
     let open Signatures.MasterWireFee in
-    verify_f ~f:Keys.verify_with_master_key master_sig_wire
+    verify Keys.master_pub master_sig_wire
       {
         h_wire_method= Hash.Cstring.H64.hash wire_method;
         start_date= fee_start;
@@ -356,7 +353,7 @@ module Global_fees = struct
           master_sig;
         } =
     let open Signatures.GlobalFees in
-    verify_f ~f:Keys.verify_with_master_key master_sig
+    verify Keys.master_pub master_sig
       {
         start_date;
         end_date;
@@ -429,7 +426,7 @@ module Wire = struct
     let debit_restrictions = "" in
     let* () =
       let open Signatures.MasterWireDetails in
-      verify_f ~f:Keys.verify_with_master_key master_sig_wire
+      verify Keys.master_pub master_sig_wire
         {
           h_wire_details= FullPaytoHash.hash payto_uri;
           h_conversion_url= Hash.Cstring.H64.hash conversion_url;
@@ -439,7 +436,7 @@ module Wire = struct
     in
     let* () =
       let open Signatures.MasterAddWire in
-      verify_f ~f:Keys.verify_with_master_key master_sig_add
+      verify Keys.master_pub master_sig_add
         {
           start_date= validity_start;
           h_wire= FullPaytoHash.hash payto_uri;
@@ -495,7 +492,7 @@ module Wire_disable = struct
   let verify (module Keys : Keys.S)
       WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } =
     let open Signatures.MasterDelWire in
-    verify_f ~f:Keys.verify_with_master_key master_sig_del
+    verify Keys.master_pub master_sig_del
       { end_date= validity_end; h_wire= FullPaytoHash.hash payto_uri }
 
   let do_ ~db_conn
@@ -538,7 +535,7 @@ module Drain = struct
           amount;
         } =
     let open Signatures.MasterDrainProfit in
-    verify_f ~f:Keys.verify_with_master_key master_sig
+    verify Keys.master_pub master_sig
       {
         wtid;
         date;
@@ -579,7 +576,7 @@ module AmlOfficer = struct
         } =
     let open Signatures.MasterAmlOfficerStatus in
     let is_active = match is_active with true -> 1_l | false -> 0_l in
-    verify_f ~f:Keys.verify_with_master_key master_sig
+    verify Keys.master_pub master_sig
       {
         change_date;
         officer_pub;
@@ -619,7 +616,7 @@ module Partners = struct
           wad_fee;
         } =
     let open Signatures.PartnerConfiguration in
-    verify_f ~f:Keys.verify_with_master_key master_sig
+    verify Keys.master_pub master_sig
       {
         partner_pub;
         start_date;
diff --git a/src/keys.ml b/src/keys.ml
index 0dba0e60..26a2a17b 100644
--- a/src/keys.ml
+++ b/src/keys.ml
@@ -41,7 +41,7 @@ module Make (Conn : Pg.CONN) = struct
       let exchange_pub = pub in
       let anchor_time = stamp_start in
       let duration = Timestamp.diff stamp_start stamp_expire in
-      sign_f ~f:Secmod_eddsa.sign_with_sm_key
+      signf Secmod_eddsa.sign_with_sm_key
         { exchange_pub; anchor_time; duration }
     in
     Api.FutureSignKey.
@@ -89,7 +89,7 @@ module Make (Conn : Pg.CONN) = struct
       let duration_withdraw =
         Timestamp.diff stamp_start stamp_expire_withdraw
       in
-      sign_f ~f:Secmod_rsa.sign_with_sm_key
+      signf Secmod_rsa.sign_with_sm_key
         { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
     in
     FutureDenom.
diff --git a/src/signatures.ml b/src/signatures.ml
index f5364000..8c92a807 100644
--- a/src/signatures.ml
+++ b/src/signatures.ml
@@ -155,21 +155,15 @@ end) : sig
   type r = R.r
   type t
 
-  val sign_f : f:(string -> eddsa_sig) -> r -> t
-
-  (* TODO
-     - just directly verify here?
-     - type for `theirs` and `ours` signatures? *)
-  val verify_f :
-    f:(eddsa_sig -> msg:string -> (unit, string) result) ->
-    t ->
-    r ->
-    (unit, string) result
+  val signf : (string -> EddsaSignature.t) -> r -> t
 
+  (* todo
+     - could have another functor with `verify`'s key set to config's master_public_key
+     - type for unknown/verified signatures? (nk/ok) *)
+  val verify : EddsaPublicKey.t -> t -> r -> (unit, string) result
   val jsont : t Jsont.t
   val caqti : t Caqti_type.t
 
-  (* TODO rm *)
   (* escape hatch, only needed for /keys `exchange_sig` (signature over contatentation of all of the master_sigs) *)
   val to_octets : t -> string
 end = struct
@@ -179,8 +173,8 @@ end = struct
   type t = EddsaSignature.t
 
   let to_string = Bin.to_string R.bin
-  let sign_f ~f r = f (to_string r)
-  let verify_f ~f t r = f t ~msg:(to_string r)
+  let verify key t r = EddsaSignature.verify ~key t ~msg:(to_string r)
+  let signf f r = f (to_string r)
   let jsont = EddsaSignature.jsont
   let caqti : EddsaSignature.t Caqti_type.t = EddsaSignature.caqti
   let to_octets t = EddsaSignature.to_octets t