diff --git a/src/secmod_rsa.ml b/src/secmod_rsa.ml
index e7318553..73255142 100644
--- a/src/secmod_rsa.ml
+++ b/src/secmod_rsa.ml
@@ -15,7 +15,7 @@ type key = {
 type t = {
   sm_key_priv: EddsaPrivateKey.t;
   sm_key_pub: EddsaPublicKey.t;
-  mutable denoms: (string * key list) list;
+  ht: (RsaPublicKey.t, key) Hashtbl.t;
 }
 
 (* -- util -- *)
@@ -101,7 +101,7 @@ let split_in_periodes ~start ~end_ =
   in
   go acc start end_
 
-let gen_additional_keys_until_lookahead ~now (section_name, l) =
+let gen_additional_keys_until_lookahead ~now ~section_name l =
   (* try to _not_ generate keys with validity start in the past
      (probably not important) *)
   let start =
@@ -140,23 +140,27 @@ let load_key ~section_name fpath =
           let pub = RsaPrivateKey.pub_of_priv priv in
           Ok (Some { section_name; priv; pub; t1; t2 }))
 
-let load_section section_fpath =
-  let section_name = Fpath.filename section_fpath in
+let load_section section_name =
+  let section_fpath = Fpath.(v Cfg.key_dir / section_name) in
   let* l = get_key_dir_contents section_fpath in
   let* l = list_map (load_key ~section_name) l in
   let keys = List.filter_map Fun.id l in
-  Ok (section_name, keys)
+  Ok keys
+
+(* TODO read from config *)
+let sections = []
 
 let load () =
-  let* l = get_key_dir_contents (Fpath.v Cfg.key_dir) in
-  (* TODO check/filter on section_name directories *)
-  let* denoms = list_map load_section l in
-  match denoms with
+  let* keys_l = list_map load_section sections in
+  let keys = List.concat keys_l in
+  match keys with
   | [] -> Ok None
   | _l ->
       let* sm_key_priv = read_eddsa sm_key_fpath in
       let sm_key_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
-      Ok (Some { sm_key_priv; sm_key_pub; denoms })
+      let ht = Hashtbl.create 0xff in
+      let () = List.iter (fun k -> Hashtbl.replace ht k.pub k) keys in
+      Ok (Some { sm_key_priv; sm_key_pub; ht })
 
 let init () =
   let* opt = load () in
@@ -166,44 +170,25 @@ let init () =
     | None ->
         let sm_key_priv, sm_key_pub = EddsaPrivateKey.generate () in
         let* () = write_eddsa sm_key_fpath sm_key_priv in
-        Ok { sm_key_priv; sm_key_pub; denoms= [] }
+        let ht = Hashtbl.create 0xff in
+        Ok { sm_key_priv; sm_key_pub; ht }
   in
-  (* TODO read from config *)
-  let sections = [] in
   let now = Absolute.of_ptime (Ptime_clock.now ()) in
-  let news =
+  let all_keys = List.of_seq @@ Hashtbl.to_seq_values t.ht in
+  let new_keys_l =
     List.map
       (fun section_name ->
-        let v =
-          match List.find_opt (fun (s, _keys) -> s = section_name) t.denoms with
-          | None -> (section_name, [])
-          | Some v -> v
+        let keys =
+          List.filter (fun k -> k.section_name = section_name) all_keys
         in
-        gen_additional_keys_until_lookahead ~now v)
+        gen_additional_keys_until_lookahead ~now ~section_name keys)
       sections
   in
-  let+ () = list_iter (list_iter write_key) news in
+  let new_keys = List.concat new_keys_l in
+  let () = List.iter (fun k -> Hashtbl.replace t.ht k.pub k) new_keys in
+  let+ () = list_iter write_key new_keys in
 
-  (* TODO better data structure *)
-  (* merge new and old *)
-  let ht = Hashtbl.create 0xff in
-  let () =
-    List.iter
-      (fun (_section_name, keys) ->
-        List.iter (fun k -> Hashtbl.replace ht k ()) keys)
-      t.denoms
-  in
-  let () = List.iter (List.iter (fun k -> Hashtbl.replace ht k ())) news in
-  let all = List.of_seq @@ Hashtbl.to_seq_keys ht in
-  let denoms =
-    List.map
-      (fun section_name ->
-        let keys = List.filter (fun k -> k.section_name = section_name) all in
-        (section_name, keys))
-      sections
-  in
-
-  { t with denoms }
+  t
 
 (* --- *)
 
@@ -213,7 +198,7 @@ let t =
   | Ok t -> t
 
 let sm_key_pub = t.sm_key_pub
-let all_keys () = List.map snd t.denoms |> List.concat
+let all_keys () = List.of_seq @@ Hashtbl.to_seq_values t.ht
 
 let keys () =
   all_keys ()
@@ -223,13 +208,19 @@ let keys () =
 let sign_with_sm_key s = EddsaSignature.sign ~key:t.sm_key_priv s
 
 let find_key pub =
-  all_keys ()
-  |> List.find_opt (fun k -> k.pub = pub)
-  |> Option.to_result ~none:"key not found"
+  Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found"
 
 let sign ~pub s =
   let+ k = find_key pub in
   let data = RsaSignature.sign ~key:k.priv s in
   data
 
-(* TODO add delete functions *)
+let delete_key pub =
+  let* k = find_key pub in
+  Hashtbl.remove t.ht k.pub; delete_key_file k
+
+let delete_outdated ~now =
+  all_keys ()
+  |> List.filter (fun k -> Absolute.compare now k.t2 >= 0)
+  |> List.map (fun k -> k.pub)
+  |> list_iter delete_key