diff --git a/src/database.ml b/src/database.ml
index 07f5661e..7ee23436 100644
--- a/src/database.ml
+++ b/src/database.ml
@@ -27,7 +27,7 @@ let dummy_master_sig =
 let test_activate req server _ =
   let db_conn = Vif.Server.device Devices.db_connection server in
   let secmod_signkey = Vif.Server.device Devices.secmod_signkey server in
-  let sm_key = secmod_signkey.sm_key in
+  let sm_key = Secmod_signkey.get_sm_key secmod_signkey in
   let sm_key = { sm_key with master_sig= dummy_master_sig } in
   let res = Pg.activate_signing_key db_conn sm_key in
   Result.fold ~ok:(on_ok req) ~error:(on_error req) res
diff --git a/src/management.ml b/src/management.ml
index e138c036..993024e7 100644
--- a/src/management.ml
+++ b/src/management.ml
@@ -67,21 +67,24 @@ let mk_future_signkey ~sm_signkey_priv
 let mk_future_keys_response ~(sm_signkey : Secmod_signkey.t)
     ~(sm_denom : Secmod_denom.t) =
   let future_signkeys =
-    sm_signkey.signkeys
+    Secmod_signkey.get_signkeys sm_signkey
     |> List.filter (fun k -> Option.is_none k.Signkey.master_sig)
     |> List.map (fun signkey ->
-        mk_future_signkey ~sm_signkey_priv:sm_signkey.sm_key.Signkey.priv
-          signkey)
+        let sm_signkey_priv =
+          (Secmod_signkey.get_sm_key sm_signkey).Signkey.priv
+        in
+        mk_future_signkey ~sm_signkey_priv signkey)
   in
   let future_denoms =
-    sm_denom.denoms
+    Secmod_denom.get_denoms sm_denom
     |> List.filter (fun k -> Option.is_none k.Denomination.master_sig)
     |> List.map (fun denom ->
-        mk_future_denom ~sm_denom_priv:sm_denom.sm_key.Signkey.priv denom)
+        let sm_denom_priv = (Secmod_denom.get_sm_key sm_denom).Signkey.priv in
+        mk_future_denom ~sm_denom_priv denom)
   in
   let master_pub = Config.Exchange.master_public_key in
-  let denom_secmod_public_key = sm_denom.sm_key.pub in
-  let signkey_secmod_public_key = sm_signkey.sm_key.pub in
+  let denom_secmod_public_key = (Secmod_denom.get_sm_key sm_denom).pub in
+  let signkey_secmod_public_key = (Secmod_signkey.get_sm_key sm_signkey).pub in
   FutureKeysResponse.
     {
       future_denoms;
@@ -162,12 +165,6 @@ let verify_master_signatures ~sm_signkeys ~sm_denoms
 
 (* --- *)
 
-let store_master_signatures _ =
-  (* TODO *)
-  Ok ()
-
-(* --- *)
-
 let respond_with_plain_text_error ?status e req =
   let open Vif.Response in
   let open Syntax in
@@ -213,11 +210,11 @@ let keys_post req server _env =
           Error msg
     in
     let* () =
-      let sm_denoms = sm_denom.denoms in
-      let sm_signkeys = sm_signkey.signkeys in
+      let sm_denoms = Secmod_denom.get_denoms sm_denom in
+      let sm_signkeys = Secmod_signkey.get_signkeys sm_signkey in
       verify_master_signatures ~sm_signkeys ~sm_denoms master_signatures
     in
-    let* () = store_master_signatures () in
+    (* TODO let* () = update_master_signatures () in*)
     Ok ""
   in
   respond_with_res res req
diff --git a/src/secmod_denom.ml b/src/secmod_denom.ml
index ba83d5b1..a2d6d6ea 100644
--- a/src/secmod_denom.ml
+++ b/src/secmod_denom.ml
@@ -3,14 +3,27 @@ open Syntax
 type t = {
   lock: Miou.Mutex.t;
   sm_key: Signkey.t;
-  mutable denoms: Denomination.t list;
+  denom_ht: (Bin_type.DenominationHash.t, Denomination.t) Hashtbl.t;
 }
 
+let get_sm_key t = t.sm_key
+
+let get_denoms t =
+  Miou.Mutex.protect t.lock @@ fun () ->
+  Hashtbl.to_seq_values t.denom_ht |> List.of_seq
+
+(* TODO *)
+let update_denoms _conn t denoms =
+  Miou.Mutex.protect t.lock @@ fun () ->
+  List.iter
+    (fun denom -> Hashtbl.replace t.denom_ht denom.Denomination.h_pub denom)
+    denoms
+
 let dir = Fpath.(v "data" / "secmod_signkey")
 
-let store_secmod_data t =
+let _store_secmod_data t =
   let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key.priv in
-  t.denoms
+  get_denoms t
   |> List.mapi (fun i key ->
       let fname = Fpath.(dir / string_of_int i) in
       (fname, key.Denomination.priv))
@@ -40,14 +53,26 @@ let load conn =
   | None, None -> Ok None
   | Some sm_key, Some denoms ->
       let lock = Miou.Mutex.create () in
-      Ok (Some { lock; sm_key; denoms })
+      let denom_ht =
+        denoms
+        |> List.map (fun v -> (v.Denomination.h_pub, v))
+        |> List.to_seq
+        |> Hashtbl.of_seq
+      in
+      Ok (Some { lock; sm_key; denom_ht })
   | _, _ -> error_invalid_state
 
 let make_new () =
   let lock = Miou.Mutex.create () in
   let sm_key = Signkey.make () in
   let denoms = List.map Denomination.make Config.Coin.all_coins in
-  { lock; sm_key; denoms }
+  let denom_ht =
+    denoms
+    |> List.map (fun v -> (v.Denomination.h_pub, v))
+    |> List.to_seq
+    |> Hashtbl.of_seq
+  in
+  { lock; sm_key; denom_ht }
 
 let init conn =
   match load conn with
diff --git a/src/secmod_denom.mli b/src/secmod_denom.mli
new file mode 100644
index 00000000..9c5b2413
--- /dev/null
+++ b/src/secmod_denom.mli
@@ -0,0 +1,6 @@
+type t
+
+val get_sm_key : t -> Signkey.t
+val get_denoms : t -> Denomination.t list
+val update_denoms : (module Pg.CONN) -> t -> Denomination.t list -> unit
+val init : (module Pg.CONN) -> t
diff --git a/src/secmod_signkey.ml b/src/secmod_signkey.ml
index 9b6cf1f6..d1a6067c 100644
--- a/src/secmod_signkey.ml
+++ b/src/secmod_signkey.ml
@@ -7,14 +7,27 @@ open Syntax
 type t = {
   lock: Miou.Mutex.t;
   sm_key: Signkey.t;
-  mutable signkeys: Signkey.t list;
+  signkey_ht: (Crypto.EddsaPublicKey.t, Signkey.t) Hashtbl.t;
 }
 
+let get_sm_key t = t.sm_key
+
+let get_signkeys t =
+  Miou.Mutex.protect t.lock @@ fun () ->
+  Hashtbl.to_seq_values t.signkey_ht |> List.of_seq
+
+(* TODO *)
+let update_signkeys _conn t signkeys =
+  Miou.Mutex.protect t.lock @@ fun () ->
+  List.iter
+    (fun signkey -> Hashtbl.replace t.signkey_ht signkey.Signkey.pub signkey)
+    signkeys
+
 let dir = Fpath.(v "data" / "secmod_signkey")
 
-let store_secmod_data t =
+let _store_secmod_data t =
   let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key.priv in
-  t.signkeys
+  get_signkeys t
   |> List.mapi (fun i key ->
       let fname = Fpath.(dir / string_of_int i) in
       (fname, key.Signkey.priv))
@@ -38,14 +51,26 @@ let load conn =
   | None, None -> Ok None
   | Some sm_key, Some signkeys ->
       let lock = Miou.Mutex.create () in
-      Ok (Some { lock; sm_key; signkeys })
+      let signkey_ht =
+        signkeys
+        |> List.map (fun v -> (v.Signkey.pub, v))
+        |> List.to_seq
+        |> Hashtbl.of_seq
+      in
+      Ok (Some { lock; sm_key; signkey_ht })
   | _, _ -> error_invalid_state
 
 let make_new () =
   let lock = Miou.Mutex.create () in
   let sm_key = Signkey.make () in
   let signkeys = [ Signkey.make () ] in
-  { lock; sm_key; signkeys }
+  let signkey_ht =
+    signkeys
+    |> List.map (fun v -> (v.Signkey.pub, v))
+    |> List.to_seq
+    |> Hashtbl.of_seq
+  in
+  { lock; sm_key; signkey_ht }
 
 let init conn =
   match load conn with
diff --git a/src/secmod_signkey.mli b/src/secmod_signkey.mli
new file mode 100644
index 00000000..a80b07de
--- /dev/null
+++ b/src/secmod_signkey.mli
@@ -0,0 +1,6 @@
+type t
+
+val get_sm_key : t -> Signkey.t
+val get_signkeys : t -> Signkey.t list
+val update_signkeys : (module Pg.CONN) -> t -> Signkey.t list -> unit
+val init : (module Pg.CONN) -> t