From aaa8771448c73df10f0816fd091677a0bcd084d5 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Fri, 20 Feb 2026 21:27:21 +0100
Subject: [PATCH]

---
 src/http_management.ml |  3 ++-
 src/keys.ml            | 21 +++++++++++++++++++++
 src/signatures.ml      |  3 +++
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/src/http_management.ml b/src/http_management.ml
index 148029a8..6e5a5858 100644
--- a/src/http_management.ml
+++ b/src/http_management.ml
@@ -75,7 +75,8 @@ module Keys_post = struct
     in
     verify_f ~f:Keys.verify_with_master_key master_sig r
 
-  let verify keys MasterSignatures.{ denom_sigs; signkey_sigs } =
+  let verify (module Keys : Keys.S)
+      MasterSignatures.{ denom_sigs; signkey_sigs } =
     let* () = list_iter (verify_denom_signature keys) denom_sigs in
     let* () = list_iter (verify_signkey_signature keys) signkey_sigs in
     Ok ()
diff --git a/src/keys.ml b/src/keys.ml
index 0dba0e60..f3ad1728 100644
--- a/src/keys.ml
+++ b/src/keys.ml
@@ -258,6 +258,27 @@ module Make (Conn : Pg.CONN) = struct
               Fmt.error "coin `%s` not found in configuration" section_name
         in
         let future_dn = make_future_dn ~coin ~pub ~start:t1 in
+
+
+    let open Signatures.DenominationKeyValidity in
+    let r =
+      R.{
+        master= Config.master_public_key;
+        start= future_dn.stamp_start;
+        expire_withdraw= future_dn.stamp_expire_withdraw;
+        expire_spend= future_dn.stamp_expire_deposit;
+        expire_legal= future_dn.stamp_expire_legal;
+        value= future_dn.value;
+        fee_withdraw= future_dn.fee_withdraw;
+        fee_deposit= future_dn.fee_deposit;
+        fee_refresh= future_dn.fee_refresh;
+        fee_refund= future_dn.fee_refund;
+        denom_hash= h_pub;
+      }
+    in
+    verify_f ~f:(EddsaSignature.verify ~key:master_pub) master_sig r
+
+
         let dn = dn_of_future_dn future_dn h_pub master_sig in
         let* () = Pg.insert_denom conn dn |> unwrap_err_caqti in
         Ok ()
diff --git a/src/signatures.ml b/src/signatures.ml
index 1d57405e..f5364000 100644
--- a/src/signatures.ml
+++ b/src/signatures.ml
@@ -157,6 +157,9 @@ end) : sig
 
   val sign_f : f:(string -> eddsa_sig) -> r -> t
 
+  (* TODO
+     - just directly verify here?
+     - type for `theirs` and `ours` signatures? *)
   val verify_f :
     f:(eddsa_sig -> msg:string -> (unit, string) result) ->
     t ->