diff --git a/src/api.ml b/src/api.ml
index 45fc0880..77a38f33 100644
--- a/src/api.ml
+++ b/src/api.ml
@@ -1,10 +1,21 @@
 (* TODO
    ppx?
 
+   normalized JSON-object
+     for signature of ExchangeKeysResponse.exetensions field
+     why is this one not defined by a struct?
+
    how to handle protocol versions:
      - "@deprecated" fields
      - "@since protocol xx"
 
+   better jsont cases handling:
+     - factorize common fields (DenomCommon/DenomGroupCommon)
+     - "+age_restricted"/CS variants
+     - raise error not implemented if not RSA
+
+   monotonic time
+
    payto_uri
    uri
    option: correct use opt_mem or Jsont.option
@@ -49,9 +60,10 @@ module Account_operation = struct
     |> Jsont.enum ~kind:"account operation type"
 end
 
-module ErrorDetail = struct
-  (* TODO GANA error codes
+(* TODO error response
+   - use GANA error codes
      https://git.gnunet.org/gana.git/tree/gnu-taler-error-codes/registry.rec *)
+module ErrorDetail = struct
   type t = {
     code: int;
     hint: string option;
@@ -484,7 +496,7 @@ module AuditorSetupMessage = struct
     auditor_name: string;
     auditor_pub: EddsaPublicKey.t;
     master_sig: MasterAddAuditorPS.t;
-    (* TODO time
+    (* TODO monotonic time
        something about using monotonic system time here! *)
     validity_start: Timestamp.t;
   }
@@ -511,8 +523,7 @@ end
 module AuditorTeardownMessage = struct
   type t = {
     master_sig: MasterDelAuditorPS.t;
-    (* TODO time
-       something about using monotonic system time here! *)
+    (* TODO monotonic time *)
     validity_end: Timestamp.t;
   }
 
@@ -533,7 +544,7 @@ module WireFeeSetupMessage = struct
     (* TODO over which struct?
        Signature using the exchange's offline key
        with purpose TALER_SIGNATURE_MASTER_WIRE_FEES *)
-    master_sig_wire: EddsaSignature.t;
+    master_sig_wire: MasterWireFeePS.t;
     fee_start: Amount.t;
     fee_end: Amount.t;
     closing_fee: Amount.t;
@@ -561,7 +572,7 @@ module WireFeeSetupMessage = struct
     let open Jsont.Object in
     map ~kind:"WireFeeSetupMessage" make
     |> mem "wire_method" Jsont.string ~enc:wire_method
-    |> mem "master_sig_wire" EddsaSignature.jsont ~enc:master_sig_wire
+    |> mem "master_sig_wire" MasterWireFeePS.jsont ~enc:master_sig_wire
     |> mem "fee_start" Amount.jsont ~enc:fee_start
     |> mem "fee_end" Amount.jsont ~enc:fee_end
     |> mem "closing_fee" Amount.jsont ~enc:closing_fee
@@ -626,7 +637,7 @@ module WireSetupMessage = struct
     payto_uri: string;
     master_sig_wire: MasterWireDetailsPS.t;
     master_sig_add: MasterAddWirePS.t;
-    (* TODO time monotonic *)
+    (* TODO monotonic time *)
     validity_start: Timestamp.t;
     bank_label: string option;
     priority: int option;
@@ -665,7 +676,7 @@ module WireTeardownMessage = struct
   type t = {
     payto_uri: string;
     master_sig_del: MasterDelWirePS.t;
-    (* TODO time monotonic *)
+    (* TODO monotonic time *)
     validity_end: Timestamp.t;
   }
 
@@ -1037,11 +1048,6 @@ module RsaDenomGroup = struct
     |> finish
 end
 
-(* TODO cases
-   better jsont cases handling
-   factorize common fields (DenomCommon/DenomGroupCommon)
-   "+age_restricted"/CS variants
-   raise error not implemented if not RSA *)
 module DenomGroup = struct
   type t = Rsa of RsaDenomGroup.t
 
@@ -1234,7 +1240,11 @@ module ExchangeKeysResponse = struct
     hard_limits: AccountLimit.t list;
     zero_limits: ZeroLimitedOperation.t list;
     denominations: DenomGroup.t list;
-    exchange_sig: EddsaSignature.t;
+    (* Compact EdDSA signature (binary-only) over the
+       contatentation of all of the master_sigs (in reverse
+       chronological order by group) in the arrays under
+       "denominations" *)
+    exchange_sig: ExchangeKeySetPS.t;
     exchange_pub: EddsaPublicKey.t;
     recoup: RecoupDenoms.t list;
     global_fees: GlobalFees.t list;
@@ -1242,6 +1252,9 @@ module ExchangeKeysResponse = struct
     auditors: AuditorKeys.t list;
     signkeys: SignKey.t list;
     extensions: ExtensionManifest.t Stdlib.Map.Make(Stdlib.String).t option;
+    (* Signature by the exchange master key of the SHA-256 hash of the
+       normalized JSON-object of field extensions, if it was set.
+       The signature has purpose TALER_SIGNATURE_MASTER_EXTENSIONS. *)
     extensions_sig: EddsaSignature.t option;
   }
 
@@ -1359,7 +1372,7 @@ module ExchangeKeysResponse = struct
          (Jsont.list ZeroLimitedOperation.jsont)
          ~enc:zero_limits
     |> mem "denominations" (Jsont.list DenomGroup.jsont) ~enc:denominations
-    |> mem "exchange_sig" EddsaSignature.jsont ~enc:exchange_sig
+    |> mem "exchange_sig" ExchangeKeySetPS.jsont ~enc:exchange_sig
     |> mem "exchange_pub" EddsaPublicKey.jsont ~enc:exchange_pub
     |> mem "recoup" (Jsont.list RecoupDenoms.jsont) ~enc:recoup
     |> mem "global_fees" (Jsont.list GlobalFees.jsont) ~enc:global_fees
diff --git a/src/bin_signature.ml b/src/bin_signature.ml
index 776a1323..b90bc52e 100644
--- a/src/bin_signature.ml
+++ b/src/bin_signature.ml
@@ -702,6 +702,28 @@ module ExchangeKeyValidityPS = struct
   include MK (R)
 end
 
+module ExchangeKeySetPS = struct
+  module R = struct
+    (* purpose.purpose = TALER_SIGNATURE_EXCHANGE_KEY_SET *)
+    type r = {
+      list_issue_date: TimeAbsoluteNBO.t;
+      hc: Hash_64.t;
+    }
+
+    let bin =
+      let open Bin in
+      Purpose.make_bin Taler_signatures.exchange_key_set @@ fun _purpose ->
+      record (fun _purpose list_issue_date hc -> { list_issue_date; hc })
+      |+ Purpose.field _purpose
+      |+ field TimeAbsoluteNBO.bin (fun t -> t.list_issue_date)
+      |+ field Hash_64.bin (fun t -> t.hc)
+      |> sealr
+  end
+
+  include R
+  include MK (R)
+end
+
 (* ### BIN IMPL END ### *)
 
 module WithdrawRequestPS = struct
@@ -812,14 +834,6 @@ module RefreshMeltConfirmationPS = struct
   }
 end
 
-module ExchangeKeySetPS = struct
-  (* purpose.purpose = TALER_SIGNATURE_EXCHANGE_KEY_SET *)
-  type t = {
-    list_issue_date: TimeAbsoluteNBO.t;
-    hc: Hash_64_cstr.t;
-  }
-end
-
 module DepositTrackPS = struct
   (* purpose.purpose = TALER_SIGNATURE_MERCHANT_TRACK_TRANSACTION *)
   type t = {