diff --git a/src/pg.ml b/src/pg.ml
index 2579af2a..5ddb8cd9 100644
--- a/src/pg.ml
+++ b/src/pg.ml
@@ -39,12 +39,13 @@ let preflight =
   in
   fun (module Conn : CONN) -> Syntax.list_iter (fun p -> Conn.exec p ()) l
 
-(* TODO revocation master_sig *)
 let find_signkey =
   let find_signkey =
     Caqti_type.(eddsa_pub ->? signkey_data)
-      "SELECT exchange_pub, valid_from, expire_sign, expire_legal, master_sig, \
-       NULL FROM exchange_sign_keys WHERE exchange_pub=$1"
+      "SELECT esk.exchange_pub, esk.valid_from, esk.expire_sign, \
+       esk.expire_legal, esk.master_sig, sr.master_sig FROM exchange_sign_keys \
+       AS esk LEFT JOIN signkey_revocations AS sr ON esk.esk_serial = \
+       sr.esk_serial WHERE esk.exchange_pub=$1"
   in
   fun (module Conn : CONN) (exchange_pub : EddsaPublicKey.t) ->
     Conn.find_opt find_signkey exchange_pub
diff --git a/src/secmod.ml b/src/secmod.ml
index 047aefab..65068174 100644
--- a/src/secmod.ml
+++ b/src/secmod.ml
@@ -74,8 +74,7 @@ module Make (Conn : Pg.CONN) = struct
 
   let dir = Fpath.(v "data" / "secmod")
 
-  let db_lookup_signkey_data conn fname priv =
-    let pub = EddsaPrivateKey.pub_of_priv priv in
+  let db_lookup_signkey_data conn fname pub =
     let* opt = Pg.find_signkey conn pub |> unwrap_err_caqti in
     match opt with
     | None ->
@@ -102,7 +101,8 @@ module Make (Conn : Pg.CONN) = struct
     match opt with
     | None -> Ok None
     | Some priv ->
-        let* sk_data = db_lookup_signkey_data conn fname priv in
+        let pub = EddsaPrivateKey.pub_of_priv priv in
+        let* sk_data = db_lookup_signkey_data conn fname pub in
         let signkey = { priv; sk_data } in
         Ok (Some signkey)