diff --git a/src/denom_data.ml b/src/denom_data.ml
index e83a80a3..c9cb8615 100644
--- a/src/denom_data.ml
+++ b/src/denom_data.ml
@@ -14,4 +14,5 @@ type t = {
   age_mask: int;
   h_pub: denomination_hash;
   master_sig: Bin_sig.DenominationKeyValidity.t option;
+  revoked_sig: Bin_sig.MasterDenominationKeyRevocation.t option;
 }
diff --git a/src/http_management.ml b/src/http_management.ml
index 15ceed25..6df1d656 100644
--- a/src/http_management.ml
+++ b/src/http_management.ml
@@ -17,6 +17,7 @@ module Keys_get = struct
          age_mask;
          h_pub;
          master_sig= _;
+         revoked_sig= _;
        } :
         Denom_data.t) =
     let denom_pub =
@@ -51,7 +52,14 @@ module Keys_get = struct
       }
 
   let mk_future_signkey ~sm
-      ({ pub; stamp_start; stamp_expire; stamp_end; master_sig= _ } :
+      ({
+         pub;
+         stamp_start;
+         stamp_expire;
+         stamp_end;
+         master_sig= _;
+         revoked_sig= _;
+       } :
         Signkey_data.t) =
     let signkey_secmod_sig =
       let open Bin_sig.SigningKeyAnnouncement in
diff --git a/src/pg.ml b/src/pg.ml
index a90846b3..1c18fb21 100644
--- a/src/pg.ml
+++ b/src/pg.ml
@@ -37,6 +37,7 @@ let preflight =
   in
   fun (module Conn : CONN) -> Syntax.list_iter (fun p -> Conn.exec p ()) l
 
+(* TODO revoked_sig *)
 let find_signkey =
   let find_signkey =
     Caqti_type.(eddsa_pub ->? signkey_data)
diff --git a/src/pg_type.ml b/src/pg_type.ml
index dd0b70f0..8c2f0298 100644
--- a/src/pg_type.ml
+++ b/src/pg_type.ml
@@ -43,11 +43,22 @@ include struct
   let planchets_hash = HashPlanchetsP.caqti
 end
 
+(* TODO revoked_sig
+   revoked_sig default to None, but could actually be revoked
+   always do a LEFT JOIN on signkey_revocations table? *)
 let signkey_data =
   let master_sig = Bin_sig.ExchangeSigningKeyValidity.caqti in
   custom
     ~encode:(fun
-        Signkey_data.{ pub; stamp_start; stamp_expire; stamp_end; master_sig }
+        Signkey_data.
+          {
+            pub;
+            stamp_start;
+            stamp_expire;
+            stamp_end;
+            master_sig;
+            revoked_sig= _;
+          }
       ->
       match master_sig with
       | None -> Error "signkey_data master_sig is none"
@@ -61,6 +72,7 @@ let signkey_data =
           stamp_expire;
           stamp_end;
           master_sig= Some master_sig;
+          revoked_sig= None;
         })
     (t5 eddsa_pub time time time master_sig)
 
@@ -83,6 +95,7 @@ let denom_data =
             age_mask;
             h_pub;
             master_sig;
+            revoked_sig= _;
           }
       ->
       match master_sig with
@@ -130,6 +143,7 @@ let denom_data =
           age_mask;
           h_pub;
           master_sig= Some master_sig;
+          revoked_sig= None;
         })
     (t12 rsa_pub amount time time time time amount amount amount amount int
        (t2 denomination_hash master_sig))
diff --git a/src/secmod.ml b/src/secmod.ml
index 9ca3727c..77a855f9 100644
--- a/src/secmod.ml
+++ b/src/secmod.ml
@@ -24,14 +24,8 @@ type t = {
   sm_key_priv: eddsa_priv;
   sm_key_pub: eddsa_pub;
   sk_ht: (eddsa_pub, signkey) Hashtbl.t;
-  sk_revoked_ht:
-    (eddsa_pub, signkey * Bin_sig.MasterSigningKeyRevocation.t) Hashtbl.t;
   dn_ht: (denomination_hash, denom) Hashtbl.t;
   dn_section_name_ht: (denomination_hash, string) Hashtbl.t;
-  dn_revoked_ht:
-    ( denomination_hash,
-      denom * Bin_sig.MasterDenominationKeyRevocation.t )
-    Hashtbl.t;
 }
 
 (* note: don't expose a signing function if we want a real "security module" one day *)
@@ -116,22 +110,24 @@ let add_denom_master_signatures conn t l =
           Ok ())
     l
 
-let revoke_signkey t exchange_pub master_sig =
+let revoke_signkey t exchange_pub revoked_sig =
   Miou.Mutex.protect t.lock @@ fun () ->
   match Hashtbl.find_opt t.sk_ht exchange_pub with
   | None -> Error "secmod failure: denomination hash not found."
   | Some signkey ->
-      Hashtbl.remove t.sk_ht exchange_pub;
-      Hashtbl.replace t.sk_revoked_ht exchange_pub (signkey, master_sig);
+      let sk_data = { signkey.sk_data with revoked_sig= Some revoked_sig } in
+      let signkey = { signkey with sk_data } in
+      Hashtbl.replace t.sk_ht exchange_pub signkey;
       Ok ()
 
-let revoke_denomination t h_denom_pub master_sig =
+let revoke_denomination t h_denom_pub revoked_sig =
   Miou.Mutex.protect t.lock @@ fun () ->
   match Hashtbl.find_opt t.dn_ht h_denom_pub with
   | None -> Error "secmod failure: denomination hash not found."
   | Some denom ->
-      Hashtbl.remove t.dn_ht h_denom_pub;
-      Hashtbl.replace t.dn_revoked_ht h_denom_pub (denom, master_sig);
+      let dn_data = { denom.dn_data with revoked_sig= Some revoked_sig } in
+      let denom = { denom with dn_data } in
+      Hashtbl.replace t.dn_ht h_denom_pub denom;
       Ok ()
 
 let dir = Fpath.(v "data" / "secmod ")
@@ -236,20 +232,9 @@ let load conn =
         |> List.to_seq
         |> Hashtbl.of_seq
       in
-      let sk_revoked_ht = Hashtbl.create 0xff in
-      let dn_revoked_ht = Hashtbl.create 0xff in
       Ok
         (Some
-           {
-             lock;
-             sm_key_priv;
-             sm_key_pub;
-             sk_ht;
-             sk_revoked_ht;
-             dn_ht;
-             dn_section_name_ht;
-             dn_revoked_ht;
-           })
+           { lock; sm_key_priv; sm_key_pub; sk_ht; dn_ht; dn_section_name_ht })
   | _, _, _ -> error_invalid_state
 
 let make_new_signkey () =
@@ -261,8 +246,10 @@ let make_new_signkey () =
   let stamp_end = stamp_expire in
   let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
   let master_sig = None in
+  let revoked_sig = None in
   let sk_data =
-    Signkey_data.{ pub; stamp_start; stamp_expire; stamp_end; master_sig }
+    Signkey_data.
+      { pub; stamp_start; stamp_expire; stamp_end; master_sig; revoked_sig }
   in
   { priv; sk_data }
 
@@ -296,6 +283,7 @@ let make_new_denom
   let priv, pub = RsaPrivateKey.generate ~bits:rsa_keysize () in
   let h_pub = Bin_type.DenominationHash.hash (RsaPublicKey.to_octets pub) in
   let master_sig = None in
+  let revoked_sig = None in
   let dn_data =
     Denom_data.
       {
@@ -312,6 +300,7 @@ let make_new_denom
         age_mask= 0;
         h_pub;
         master_sig;
+        revoked_sig;
       }
   in
   { priv; dn_data }
@@ -335,18 +324,7 @@ let make_new () =
     |> List.to_seq
     |> Hashtbl.of_seq
   in
-  let sk_revoked_ht = Hashtbl.create 0xff in
-  let dn_revoked_ht = Hashtbl.create 0xff in
-  {
-    lock;
-    sm_key_priv;
-    sm_key_pub;
-    sk_ht;
-    sk_revoked_ht;
-    dn_ht;
-    dn_section_name_ht;
-    dn_revoked_ht;
-  }
+  { lock; sm_key_priv; sm_key_pub; sk_ht; dn_ht; dn_section_name_ht }
 
 let init conn =
   match load conn with
diff --git a/src/secmod.mli b/src/secmod.mli
index 4a0778ea..9dda7677 100644
--- a/src/secmod.mli
+++ b/src/secmod.mli
@@ -19,6 +19,9 @@ val find_denom_data : t -> denomination_hash -> Denom_data.t option
 val find_denom_section_name : t -> denomination_hash -> string option
 
 (* - management operations - *)
+(* TODO
+   problem of keeping db and secmod state syncronized
+   do db interaction from secmod? *)
 val init : (module Pg.CONN) -> t
 
 val add_signkey_master_signatures :
diff --git a/src/signkey_data.ml b/src/signkey_data.ml
index 9e2697c1..e5700d64 100644
--- a/src/signkey_data.ml
+++ b/src/signkey_data.ml
@@ -6,4 +6,5 @@ type t = {
   stamp_expire: Timestamp.t;
   stamp_end: Timestamp.t;
   master_sig: Bin_sig.ExchangeSigningKeyValidity.t option;
+  revoked_sig: Bin_sig.MasterSigningKeyRevocation.t option;
 }