diff --git a/src/devices.ml b/src/devices.ml
index 7da26428..c37d5f76 100644
--- a/src/devices.ml
+++ b/src/devices.ml
@@ -22,5 +22,5 @@ let secmod =
   let finally _key = () in
   Vif.Device.v ~name:"secmod" ~finally [ Vif.Device.value db_connection ]
   @@ fun (module Conn : Pg.CONN) (_env : env) ->
-  let sm : (module Secmod.S) = (module Secmod.Make (Conn)) in
+  let sm : (module Keys.S) = (module Keys.Make (Conn)) in
   sm
diff --git a/src/http_information.ml b/src/http_information.ml
index 17186d5a..8d480d3a 100644
--- a/src/http_information.ml
+++ b/src/http_information.ml
@@ -59,7 +59,7 @@ let denomgroup_of_denomdata
     RsaDenomGroup.
       { denoms; value; fee_withdraw; fee_deposit; fee_refresh; fee_refund }
 
-let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date =
+let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date =
   let version = Api.protocol_version in
   let base_url = Config.base_url in
   let currency = Config.currency in
@@ -113,7 +113,7 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date =
   let zero_limits = [] in
   let dn_l =
     (*Pg.get_denominations db_conn |> unwrap_err_caqti *)
-    Sm.get_denominations ()
+    Keys.get_denominations ()
     |>
     (* reverse chronological order *)
     List.sort (fun a b ->
@@ -151,7 +151,7 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date =
     (*
     let now = Ptime_clock.now () |> Option.some in
     let+ signkey_data_l = Pg.get_active_signkeys db_conn ~now |> unwrap_err_caqti in*)
-    Sm.get_signkeys ()
+    Keys.get_signkeys ()
     |> List.sort (fun a b ->
         let open Signkey in
         Stdlib.compare b.stamp_start a.stamp_start)
@@ -176,7 +176,9 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date =
       |> Hash.H64.hash
     in
     let open Signatures.ExchangeKeySet in
-    sign_f ~f:(Sm.sign_with_signkey ~pub:exchange_pub) R.{ list_issue_date; hc }
+    sign_f
+      ~f:(Keys.sign_with_signkey ~pub:exchange_pub)
+      R.{ list_issue_date; hc }
   in
 
   let recoup = (* TODO /recoup *) [] in
diff --git a/src/http_management.ml b/src/http_management.ml
index 6e739205..9ba83b1b 100644
--- a/src/http_management.ml
+++ b/src/http_management.ml
@@ -3,12 +3,12 @@ open Api
 open Hash
 
 module Keys_get = struct
-  let mk_future_keys_response (module Sm : Secmod.S) =
-    let future_signkeys = Sm.get_future_signkeys () in
-    let future_denoms = Sm.get_future_denominations () in
+  let mk_future_keys_response (module Keys : Keys.S) =
+    let future_signkeys = Keys.get_future_signkeys () in
+    let future_denoms = Keys.get_future_denominations () in
     let master_pub = Config.Exchange.master_public_key in
-    let denom_secmod_public_key = Sm.sm_pubkey in
-    let signkey_secmod_public_key = Sm.sm_pubkey in
+    let denom_secmod_public_key = Keys.sm_pubkey in
+    let signkey_secmod_public_key = Keys.sm_pubkey in
     FutureKeysResponse.
       {
         future_denoms;
@@ -36,10 +36,10 @@ module Keys_post = struct
     "404 not found, One of the keys for which a signature was provided is \
      unknown to the exchange."
 
-  let verify_denom_signature (module Sm : Secmod.S)
+  let verify_denom_signature (module Keys : Keys.S)
       DenomSignature.{ h_denom_pub; master_sig } =
     let* denom =
-      Sm.find_future_denomination h_denom_pub
+      Keys.find_future_denomination h_denom_pub
       |> Option.to_result ~none:error_key_unknown
     in
     let open Signatures.DenominationKeyValidity in
@@ -58,12 +58,12 @@ module Keys_post = struct
         denom_hash= h_denom_pub;
       }
     in
-    verify_f ~f:Sm.verify_with_master_key master_sig r
+    verify_f ~f:Keys.verify_with_master_key master_sig r
 
-  let verify_signkey_signature (module Sm : Secmod.S)
+  let verify_signkey_signature (module Keys : Keys.S)
       SignKeySignature.{ key; master_sig } =
     let* signkey =
-      Sm.find_future_signkey key |> Option.to_result ~none:error_key_unknown
+      Keys.find_future_signkey key |> Option.to_result ~none:error_key_unknown
     in
     let open Signatures.ExchangeSigningKeyValidity in
     let r : r =
@@ -74,28 +74,28 @@ module Keys_post = struct
         signkey_pub= signkey.key;
       }
     in
-    verify_f ~f:Sm.verify_with_master_key master_sig r
+    verify_f ~f:Keys.verify_with_master_key master_sig r
 
   let verify sm MasterSignatures.{ denom_sigs; signkey_sigs } =
     let* () = list_iter (verify_denom_signature sm) denom_sigs in
     let* () = list_iter (verify_signkey_signature sm) signkey_sigs in
     Ok ()
 
-  let do_ ~db_conn:_ (module Sm : Secmod.S)
+  let do_ ~db_conn:_ (module Keys : Keys.S)
       MasterSignatures.{ denom_sigs; signkey_sigs } =
     let* () =
       list_iter
         (fun SignKeySignature.{ key; master_sig } ->
-          Sm.certify_future_signkey key ~master_sig)
+          Keys.certify_future_signkey key ~master_sig)
         signkey_sigs
     in
     let* () =
       list_iter
         (fun DenomSignature.{ h_denom_pub; master_sig } ->
-          Sm.certify_future_denomination h_denom_pub ~master_sig)
+          Keys.certify_future_denomination h_denom_pub ~master_sig)
         denom_sigs
     in
-    let* () = Sm.save () in
+    let* () = Keys.save () in
     Ok ()
 
   let jsont = MasterSignatures.jsont
@@ -114,14 +114,14 @@ module Keys_post = struct
 end
 
 module Denom_revoke = struct
-  let verify (module Sm : Secmod.S) h_denom_pub
+  let verify (module Keys : Keys.S) h_denom_pub
       DenomRevocationSignature.{ master_sig } =
     let open Signatures.MasterDenominationKeyRevocation in
-    verify_f ~f:Sm.verify_with_master_key master_sig { h_denom_pub }
+    verify_f ~f:Keys.verify_with_master_key master_sig { h_denom_pub }
 
-  let do_ ~db_conn (module Sm : Secmod.S) h_denom_pub
+  let do_ ~db_conn (module Keys : Keys.S) h_denom_pub
       DenomRevocationSignature.{ master_sig } =
-    let* () = Sm.revoke_denomination h_denom_pub master_sig in
+    let* () = Keys.revoke_denomination h_denom_pub master_sig in
     let+ () =
       Pg.insert_denomination_revocation db_conn h_denom_pub master_sig
       |> unwrap_err_caqti
@@ -145,14 +145,14 @@ module Denom_revoke = struct
 end
 
 module Signkey_revoke = struct
-  let verify (module Sm : Secmod.S) exchange_pub
+  let verify (module Keys : Keys.S) exchange_pub
       SignkeyRevocationSignature.{ master_sig } =
     let open Signatures.MasterSigningKeyRevocation in
-    verify_f ~f:Sm.verify_with_master_key master_sig { exchange_pub }
+    verify_f ~f:Keys.verify_with_master_key master_sig { exchange_pub }
 
-  let do_ ~db_conn (module Sm : Secmod.S) exchange_pub
+  let do_ ~db_conn (module Keys : Keys.S) exchange_pub
       SignkeyRevocationSignature.{ master_sig } =
-    let* () = Sm.revoke_signkey exchange_pub master_sig in
+    let* () = Keys.revoke_signkey exchange_pub master_sig in
     let+ () =
       Pg.insert_signkey_revocation db_conn exchange_pub master_sig
       |> unwrap_err_caqti
@@ -176,7 +176,7 @@ module Signkey_revoke = struct
 end
 
 module Auditors = struct
-  let verify (module Sm : Secmod.S)
+  let verify (module Keys : Keys.S)
       AuditorSetupMessage.
         {
           auditor_url;
@@ -186,7 +186,7 @@ module Auditors = struct
           validity_start;
         } =
     let open Signatures.MasterAddAuditor in
-    verify_f ~f:Sm.verify_with_master_key master_sig
+    verify_f ~f:Keys.verify_with_master_key master_sig
       {
         start_date= validity_start;
         auditor_pub;
@@ -230,10 +230,10 @@ module Auditors = struct
 end
 
 module Auditors_disable = struct
-  let verify (module Sm : Secmod.S) auditor_pub
+  let verify (module Keys : Keys.S) auditor_pub
       AuditorTeardownMessage.{ master_sig; validity_end } =
     let open Signatures.MasterDelAuditor in
-    verify_f ~f:Sm.verify_with_master_key master_sig
+    verify_f ~f:Keys.verify_with_master_key master_sig
       { end_date= validity_end; auditor_pub }
 
   let do_ ~db_conn auditor_pub
@@ -271,7 +271,7 @@ module Auditors_disable = struct
 end
 
 module Wire_fee = struct
-  let verify (module Sm : Secmod.S)
+  let verify (module Keys : Keys.S)
       WireFeeSetupMessage.
         {
           wire_method;
@@ -282,7 +282,7 @@ module Wire_fee = struct
           wire_fee;
         } =
     let open Signatures.MasterWireFee in
-    verify_f ~f:Sm.verify_with_master_key master_sig_wire
+    verify_f ~f:Keys.verify_with_master_key master_sig_wire
       {
         h_wire_method= Hash.Cstring.H64.hash wire_method;
         start_date= fee_start;
@@ -330,7 +330,7 @@ module Wire_fee = struct
 end
 
 module Global_fees = struct
-  let verify (module Sm : Secmod.S)
+  let verify (module Keys : Keys.S)
       GlobalFees.
         {
           start_date;
@@ -344,7 +344,7 @@ module Global_fees = struct
           master_sig;
         } =
     let open Signatures.GlobalFees in
-    verify_f ~f:Sm.verify_with_master_key master_sig
+    verify_f ~f:Keys.verify_with_master_key master_sig
       {
         start_date;
         end_date;
@@ -401,7 +401,7 @@ module Global_fees = struct
 end
 
 module Wire = struct
-  let verify (module Sm : Secmod.S)
+  let verify (module Keys : Keys.S)
       WireSetupMessage.
         {
           payto_uri;
@@ -417,7 +417,7 @@ module Wire = struct
     let debit_restrictions = "" in
     let* () =
       let open Signatures.MasterWireDetails in
-      verify_f ~f:Sm.verify_with_master_key master_sig_wire
+      verify_f ~f:Keys.verify_with_master_key master_sig_wire
         {
           h_wire_details= FullPaytoHash.hash payto_uri;
           h_conversion_url= Hash.Cstring.H64.hash conversion_url;
@@ -427,7 +427,7 @@ module Wire = struct
     in
     let* () =
       let open Signatures.MasterAddWire in
-      verify_f ~f:Sm.verify_with_master_key master_sig_add
+      verify_f ~f:Keys.verify_with_master_key master_sig_add
         {
           start_date= validity_start;
           h_wire= FullPaytoHash.hash payto_uri;
@@ -480,10 +480,10 @@ module Wire = struct
 end
 
 module Wire_disable = struct
-  let verify (module Sm : Secmod.S)
+  let verify (module Keys : Keys.S)
       WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } =
     let open Signatures.MasterDelWire in
-    verify_f ~f:Sm.verify_with_master_key master_sig_del
+    verify_f ~f:Keys.verify_with_master_key master_sig_del
       { end_date= validity_end; h_wire= FullPaytoHash.hash payto_uri }
 
   let do_ ~db_conn
@@ -515,7 +515,7 @@ module Wire_disable = struct
 end
 
 module Drain = struct
-  let verify (module Sm : Secmod.S)
+  let verify (module Keys : Keys.S)
       DrainProfitsMessage.
         {
           debit_account_section;
@@ -526,7 +526,7 @@ module Drain = struct
           amount;
         } =
     let open Signatures.MasterDrainProfit in
-    verify_f ~f:Sm.verify_with_master_key master_sig
+    verify_f ~f:Keys.verify_with_master_key master_sig
       {
         wtid;
         date;
@@ -555,7 +555,7 @@ module Drain = struct
 end
 
 module AmlOfficer = struct
-  let verify (module Sm : Secmod.S)
+  let verify (module Keys : Keys.S)
       AmlOfficerSetup.
         {
           officer_pub;
@@ -567,7 +567,7 @@ module AmlOfficer = struct
         } =
     let open Signatures.MasterAmlOfficerStatus in
     let is_active = match is_active with true -> 1_l | false -> 0_l in
-    verify_f ~f:Sm.verify_with_master_key master_sig
+    verify_f ~f:Keys.verify_with_master_key master_sig
       {
         change_date;
         officer_pub;
@@ -595,7 +595,7 @@ module AmlOfficer = struct
 end
 
 module Partners = struct
-  let verify (module Sm : Secmod.S)
+  let verify (module Keys : Keys.S)
       ExchangePartnerSetupRequest.
         {
           partner_base_url;
@@ -607,7 +607,7 @@ module Partners = struct
           wad_fee;
         } =
     let open Signatures.PartnerConfiguration in
-    verify_f ~f:Sm.verify_with_master_key master_sig
+    verify_f ~f:Keys.verify_with_master_key master_sig
       {
         partner_pub;
         start_date;
diff --git a/src/secmod.ml b/src/keys.ml
similarity index 100%
rename from src/secmod.ml
rename to src/keys.ml
diff --git a/src/secmod.mli b/src/keys.mli
similarity index 100%
rename from src/secmod.mli
rename to src/keys.mli