diff --git a/src/data_file.ml b/src/data_file.ml
index a95f5817..44b98908 100644
--- a/src/data_file.ml
+++ b/src/data_file.ml
@@ -30,29 +30,3 @@ let read_rsa fname =
       RsaPrivateKey.of_octets data |> function
       | Error e -> Error (`Msg e)
       | Ok v -> Ok (Some v))
-
-(* todo: move this *)
-let db_lookup_signkey_data conn fname priv =
-  let pub = Crypto.EddsaPrivateKey.pub_of_priv priv in
-  let* opt = Pg.lookup_signing_key conn pub in
-  match opt with
-  | None ->
-      Fmt.error_msg
-        "load_signkey error no associated metadata found in database for \
-         signkey `%s`."
-        (Fpath.to_string fname)
-  | Some (stamp_start, stamp_expire, stamp_end) ->
-      (* TODO master_sig *)
-      let master_sig = None in
-      let v =
-        Signkey.{ pub; priv; stamp_start; stamp_expire; stamp_end; master_sig }
-      in
-      Ok v
-
-let load_signkey conn fname =
-  let* opt = read_eddsa fname in
-  match opt with
-  | None -> Ok None
-  | Some priv ->
-      let* signkey_data = db_lookup_signkey_data conn fname priv in
-      Ok (Some signkey_data)
diff --git a/src/management.ml b/src/management.ml
index 09c64427..61e1f565 100644
--- a/src/management.ml
+++ b/src/management.ml
@@ -70,23 +70,19 @@ module Keys_get = struct
       Secmod_signkey.get_signkeys sm_signkey
       |> List.filter (fun k -> Option.is_none k.Signkey.master_sig)
       |> List.map (fun signkey ->
-          let sm_signkey_priv =
-            (Secmod_signkey.get_sm_key sm_signkey).Signkey.priv
-          in
+          let sm_signkey_priv = Secmod_signkey.get_sm_key_priv sm_signkey in
           mk_future_signkey ~sm_signkey_priv signkey)
     in
     let future_denoms =
       Secmod_denom.get_denoms sm_denom
       |> List.filter (fun k -> Option.is_none k.Denomination.master_sig)
       |> List.map (fun denom ->
-          let sm_denom_priv = (Secmod_denom.get_sm_key sm_denom).Signkey.priv in
+          let sm_denom_priv = Secmod_denom.get_sm_key_priv sm_denom in
           mk_future_denom ~sm_denom_priv denom)
     in
     let master_pub = Config.Exchange.master_public_key in
-    let denom_secmod_public_key = (Secmod_denom.get_sm_key sm_denom).pub in
-    let signkey_secmod_public_key =
-      (Secmod_signkey.get_sm_key sm_signkey).pub
-    in
+    let denom_secmod_public_key = Secmod_denom.get_sm_key_pub sm_denom in
+    let signkey_secmod_public_key = Secmod_signkey.get_sm_key_pub sm_signkey in
     FutureKeysResponse.
       {
         future_denoms;
diff --git a/src/secmod_denom.ml b/src/secmod_denom.ml
index 582d1ef7..0c9ad36b 100644
--- a/src/secmod_denom.ml
+++ b/src/secmod_denom.ml
@@ -3,11 +3,14 @@
    (missing master_sig for fresh denom) *)
 open Syntax
 
+type eddsa_priv = Crypto.EddsaPrivateKey.t
+type eddsa_pub = Crypto.EddsaPublicKey.t
 type h_denom_pub = Bin_type.DenominationHash.t
 
 type t = {
   lock: Miou.Mutex.t;
-  sm_key: Signkey.t;
+  sm_key_priv: eddsa_priv;
+  sm_key_pub: eddsa_pub;
   denom_ht: (h_denom_pub, Denomination.t) Hashtbl.t;
   revoked_ht:
     ( h_denom_pub,
@@ -15,7 +18,8 @@ type t = {
     Hashtbl.t;
 }
 
-let get_sm_key t = t.sm_key
+let get_sm_key_pub t = t.sm_key_pub
+let get_sm_key_priv t = t.sm_key_priv
 
 let get_denoms t =
   Miou.Mutex.protect t.lock @@ fun () ->
@@ -49,7 +53,7 @@ let dir = Fpath.(v "data" / "secmod_signkey")
 
 (* TODO secmod store *)
 let _store_secmod_data t =
-  let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key.priv in
+  let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key_priv in
   get_denoms t
   |> List.mapi (fun i key ->
       let fname = Fpath.(dir / string_of_int i) in
@@ -106,7 +110,7 @@ let load conn =
   let error_invalid_state =
     Fmt.error_msg "secmod_denom load error: invalid store state."
   in
-  let* sm_key = Data_file.load_signkey conn Fpath.(dir / "sm_key") in
+  let* sm_key_priv = Data_file.read_eddsa Fpath.(dir / "sm_key") in
   let* denoms =
     let* l =
       let open Config.Coin in
@@ -127,9 +131,10 @@ let load conn =
     | Error () -> error_invalid_state
     | Ok opt -> Ok opt
   in
-  match (sm_key, denoms) with
+  match (sm_key_priv, denoms) with
   | None, None -> Ok None
-  | Some sm_key, Some denoms ->
+  | Some sm_key_priv, Some denoms ->
+      let sm_key_pub = Crypto.EddsaPrivateKey.pub_of_priv sm_key_priv in
       let lock = Miou.Mutex.create () in
       let denom_ht =
         denoms
@@ -138,12 +143,12 @@ let load conn =
         |> Hashtbl.of_seq
       in
       let revoked_ht = Hashtbl.create 0xff in
-      Ok (Some { lock; sm_key; denom_ht; revoked_ht })
+      Ok (Some { lock; sm_key_priv; sm_key_pub; denom_ht; revoked_ht })
   | _, _ -> error_invalid_state
 
 let make_new () =
   let lock = Miou.Mutex.create () in
-  let sm_key = Signkey.make () in
+  let sm_key_priv, sm_key_pub = Mirage_crypto_ec.Ed25519.generate () in
   let denoms = List.map Denomination.make Config.Coin.all_coins in
   let denom_ht =
     denoms
@@ -152,7 +157,7 @@ let make_new () =
     |> Hashtbl.of_seq
   in
   let revoked_ht = Hashtbl.create 0xff in
-  { lock; sm_key; denom_ht; revoked_ht }
+  { lock; sm_key_priv; sm_key_pub; denom_ht; revoked_ht }
 
 let init conn =
   match load conn with
diff --git a/src/secmod_denom.mli b/src/secmod_denom.mli
index 117e1c97..1be7ea62 100644
--- a/src/secmod_denom.mli
+++ b/src/secmod_denom.mli
@@ -1,10 +1,16 @@
 open Bin_sig
 
+type eddsa_priv = Crypto.EddsaPrivateKey.t
+type eddsa_pub = Crypto.EddsaPublicKey.t
 type h_denom_pub = Bin_type.DenominationHash.t
 type t
 
-val get_sm_key : t -> Signkey.t
+val get_sm_key_priv : t -> eddsa_priv
+val get_sm_key_pub : t -> eddsa_pub
 val get_denoms : t -> Denomination.t list
+val init : (module Pg.CONN) -> t
+
+(* - management operations - *)
 
 val add_master_signatures :
   (module Pg.CONN) ->
@@ -14,5 +20,3 @@ val add_master_signatures :
 
 val revoke_denomination :
   t -> h_denom_pub -> MasterDenominationKeyRevocation.t -> (unit, string) result
-
-val init : (module Pg.CONN) -> t
diff --git a/src/secmod_signkey.ml b/src/secmod_signkey.ml
index 8ca280fc..db0df105 100644
--- a/src/secmod_signkey.ml
+++ b/src/secmod_signkey.ml
@@ -1,20 +1,24 @@
 (* TODO
    - key rotation
    - how many signkey to use?
-     we just use 1 for now *)
+     we just use 1 for now
+   - does the secmod's key as metadata/expiration date? *)
 open Syntax
 
-type exchange_pub = Crypto.EddsaPublicKey.t
+type eddsa_priv = Crypto.EddsaPrivateKey.t
+type eddsa_pub = Crypto.EddsaPublicKey.t
 
 type t = {
   lock: Miou.Mutex.t;
-  sm_key: Signkey.t;
-  signkey_ht: (exchange_pub, Signkey.t) Hashtbl.t;
+  sm_key_priv: eddsa_priv;
+  sm_key_pub: eddsa_pub;
+  signkey_ht: (eddsa_pub, Signkey.t) Hashtbl.t;
   revoked_ht:
-    (exchange_pub, Signkey.t * Bin_sig.MasterSigningKeyRevocation.t) Hashtbl.t;
+    (eddsa_pub, Signkey.t * Bin_sig.MasterSigningKeyRevocation.t) Hashtbl.t;
 }
 
-let get_sm_key t = t.sm_key
+let get_sm_key_priv t = t.sm_key_priv
+let get_sm_key_pub t = t.sm_key_pub
 
 let get_signkeys t =
   Miou.Mutex.protect t.lock @@ fun () ->
@@ -46,8 +50,33 @@ let revoke_signkey t exchange_pub master_sig =
 
 let dir = Fpath.(v "data" / "secmod_signkey")
 
+let db_lookup_signkey_data conn fname priv =
+  let pub = Crypto.EddsaPrivateKey.pub_of_priv priv in
+  let* opt = Pg.lookup_signing_key conn pub in
+  match opt with
+  | None ->
+      Fmt.error_msg
+        "load_signkey error no associated metadata found in database for \
+         signkey `%s`."
+        (Fpath.to_string fname)
+  | Some (stamp_start, stamp_expire, stamp_end) ->
+      (* TODO master_sig *)
+      let master_sig = None in
+      let v =
+        Signkey.{ pub; priv; stamp_start; stamp_expire; stamp_end; master_sig }
+      in
+      Ok v
+
+let load_signkey conn fname =
+  let* opt = Data_file.read_eddsa fname in
+  match opt with
+  | None -> Ok None
+  | Some priv ->
+      let* signkey_data = db_lookup_signkey_data conn fname priv in
+      Ok (Some signkey_data)
+
 let _store_secmod_data t =
-  let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key.priv in
+  let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key_priv in
   get_signkeys t
   |> List.mapi (fun i key ->
       let fname = Fpath.(dir / string_of_int i) in
@@ -58,15 +87,16 @@ let load conn =
   let error_invalid_state =
     Fmt.error_msg "secmod_signkey load error: invalid store state."
   in
-  let* sm_key = Data_file.load_signkey conn Fpath.(dir / "sm_key") in
+  let* sm_key_priv = Data_file.read_eddsa Fpath.(dir / "sm_key") in
   let* signkeys =
     let l = List.init 1 (fun i -> Fpath.(dir / string_of_int i)) in
-    let* l = list_map (fun fname -> Data_file.load_signkey conn fname) l in
+    let* l = list_map (fun fname -> load_signkey conn fname) l in
     match opt_list l with Error () -> error_invalid_state | Ok opt -> Ok opt
   in
-  match (sm_key, signkeys) with
+  match (sm_key_priv, signkeys) with
   | None, None -> Ok None
-  | Some sm_key, Some signkeys ->
+  | Some sm_key_priv, Some signkeys ->
+      let sm_key_pub = Crypto.EddsaPrivateKey.pub_of_priv sm_key_priv in
       let lock = Miou.Mutex.create () in
       let signkey_ht =
         signkeys
@@ -75,12 +105,12 @@ let load conn =
         |> Hashtbl.of_seq
       in
       let revoked_ht = Hashtbl.create 0xff in
-      Ok (Some { lock; sm_key; signkey_ht; revoked_ht })
+      Ok (Some { lock; sm_key_priv; sm_key_pub; signkey_ht; revoked_ht })
   | _, _ -> error_invalid_state
 
 let make_new () =
   let lock = Miou.Mutex.create () in
-  let sm_key = Signkey.make () in
+  let sm_key_priv, sm_key_pub = Mirage_crypto_ec.Ed25519.generate () in
   let signkeys = [ Signkey.make () ] in
   let signkey_ht =
     signkeys
@@ -89,7 +119,7 @@ let make_new () =
     |> Hashtbl.of_seq
   in
   let revoked_ht = Hashtbl.create 0xff in
-  { lock; sm_key; signkey_ht; revoked_ht }
+  { lock; sm_key_priv; sm_key_pub; signkey_ht; revoked_ht }
 
 let init conn =
   match load conn with
diff --git a/src/secmod_signkey.mli b/src/secmod_signkey.mli
index 6d97f2f5..2149f943 100644
--- a/src/secmod_signkey.mli
+++ b/src/secmod_signkey.mli
@@ -1,19 +1,22 @@
 type t
-type exchange_pub = Crypto.EddsaPublicKey.t
+type eddsa_priv = Crypto.EddsaPrivateKey.t
+type eddsa_pub = Crypto.EddsaPublicKey.t
 
-val get_sm_key : t -> Signkey.t
+val get_sm_key_priv : t -> eddsa_priv
+val get_sm_key_pub : t -> eddsa_pub
 val get_signkeys : t -> Signkey.t list
+val init : (module Pg.CONN) -> t
+
+(* - management operations - *)
 
 val add_master_signatures :
   (module Pg.CONN) ->
   t ->
-  (exchange_pub * Bin_sig.ExchangeSigningKeyValidity.t) list ->
+  (eddsa_pub * Bin_sig.ExchangeSigningKeyValidity.t) list ->
   (unit, string) result
 
 val revoke_signkey :
   t ->
-  exchange_pub ->
+  eddsa_pub ->
   Bin_sig.MasterSigningKeyRevocation.t ->
   (unit, string) result
-
-val init : (module Pg.CONN) -> t