diff --git a/src/binary_formats.ml b/src/binary_formats.ml
index 4ddcc135..d2742054 100644
--- a/src/binary_formats.ml
+++ b/src/binary_formats.ml
@@ -246,9 +246,8 @@ include UTIL
 (* -- Cryptographic primitives -- *)
 
 module DenominationHash = MK_SRC_HASH_32 (struct
-  type src = Mirage_crypto_pk.Rsa.pub
+  type src = Types.RsaPublicKey.t
 
-  (* function to convert src type to a string for hashing *)
   let to_octets = Types.RsaPublicKey.to_octets
 end)
 
diff --git a/src/denomination.ml b/src/denomination.ml
index 99ca9002..a1e48c0f 100644
--- a/src/denomination.ml
+++ b/src/denomination.ml
@@ -1,6 +1,7 @@
 open Types
 
 type t = {
+  pub: RsaPublicKey.t;
   section_name: string;
   value: Amount.t;
   stamp_start: Ptime.t;
@@ -11,8 +12,9 @@ type t = {
   fee_deposit: Amount.t;
   fee_refresh: Amount.t;
   fee_refund: Amount.t;
-  pub: RsaPublicKey.t;
+  h_pub: Binary_formats.DenominationHash.t;
   sign: string -> RsaSignature.t;
+  master_sig: EddsaSignature.t option;
 }
 
 let hash_pub _pub =
@@ -49,8 +51,11 @@ let make
   let open Mirage_crypto_pk.Rsa in
   let priv = generate ~bits:rsa_keysize () in
   let pub = pub_of_priv priv in
+  let h_pub = Binary_formats.DenominationHash.hash pub in
   let sign = RsaSignature.sign ~key:priv in
+  let master_sig = None in
   {
+    pub;
     section_name;
     value;
     stamp_start;
@@ -61,6 +66,7 @@ let make
     fee_deposit;
     fee_refresh;
     fee_refund;
-    pub;
+    h_pub;
     sign;
+    master_sig;
   }
diff --git a/src/devices.ml b/src/devices.ml
index f58d3c47..6f7c1968 100644
--- a/src/devices.ml
+++ b/src/devices.ml
@@ -1,15 +1,30 @@
-(* TODO
-   better types to not mixup keys maybe
-   .. *)
+module Secmod_signkey = struct
+  type t = {
+    secmod_key: Signkey.t;
+    keys: Signkey.t list;
+  }
 
-let signkey = Signkey.make ~name:"signkey"
-let online_key = Signkey.make ~name:"online_key"
-let denom_key = Signkey.make ~name:"denom_key"
+  let v =
+    let finally _key = () in
+    Vif.Device.v ~name:"secmod_signkey" ~finally [] @@ fun () ->
+    let secmod_key = Signkey.generate () in
+    let keys = [ Signkey.generate () ] in
+    { secmod_key; keys }
+end
 
-let denominations =
-  let finally _key = () in
-  Vif.Device.v ~name:"denominations" ~finally [] @@ fun () ->
-  let rsa_l = List.map Denomination.make Config.coins in
-  rsa_l
+module Secmod_denom = struct
+  type t = {
+    secmod_key: Signkey.t;
+    keys: Denomination.t list;
+  }
 
-let l = Vif.Devices.[ signkey; online_key; denom_key; denominations ]
+  let v =
+    let finally _key = () in
+    Vif.Device.v ~name:"secmod_denom" ~finally [] @@ fun () ->
+    let secmod_key = Signkey.generate () in
+    let keys = List.map Denomination.make Config.coins in
+    { secmod_key; keys }
+end
+
+let secmod_signkey = Secmod_signkey.v
+let secmod_denom = Secmod_denom.v
diff --git a/src/management.ml b/src/management.ml
index fc5c63e2..23aea7fb 100644
--- a/src/management.ml
+++ b/src/management.ml
@@ -1,8 +1,10 @@
 (*open Types*)
 open Api_types
+open Devices
 
 let mk_future_denom denom_key_signf
     ({
+       pub;
        section_name;
        value;
        stamp_start;
@@ -13,8 +15,9 @@ let mk_future_denom denom_key_signf
        fee_deposit;
        fee_refresh;
        fee_refund;
-       pub;
+       h_pub;
        sign= _;
+       master_sig= _;
      } :
       Denomination.t) =
   let denom_pub =
@@ -22,7 +25,7 @@ let mk_future_denom denom_key_signf
   in
   let denom_secmod_sig =
     let open Binary_formats in
-    let h_denom_pub = DenominationHash.hash pub in
+    let h_denom_pub = h_pub in
     let h_section_name = Cstring_hash_64.hash section_name in
     let anchor_time =
       TimeAbsoluteNBO.{ v= Util.ptime_to_int64_us stamp_start }
@@ -58,7 +61,8 @@ let mk_future_denom denom_key_signf
     }
 
 let mk_future_signkey signkey_signf
-    ({ pub; sign= _; stamp_start; stamp_expire; stamp_end } : Signkey.t) =
+    ({ pub; stamp_start; stamp_expire; stamp_end; sign= _; master_sig= _ } :
+      Signkey.t) =
   let signkey_secmod_sig =
     let open Binary_formats in
     let exchange_pub = pub in
@@ -85,18 +89,21 @@ let mk_future_signkey signkey_signf
       signkey_secmod_sig;
     }
 
-let mk_future_keys_response ~signkey ~online_key ~denom_key ~denominations =
+let mk_future_keys_response (secmod_signkey : Secmod_signkey.t)
+    (secmod_denom : Secmod_denom.t) =
   let future_denoms =
-    (* todo: "only those lacking a master signature" *)
-    List.map (mk_future_denom denom_key.Signkey.sign) denominations
+    secmod_denom.keys
+    |> List.filter (fun k -> Option.is_none k.Denomination.master_sig)
+    |> List.map (mk_future_denom secmod_denom.secmod_key.Signkey.sign)
   in
   let future_signkeys =
-    (* todo: "only those lacking a master signature" *)
-    List.map (mk_future_signkey signkey.Signkey.sign) [ online_key ]
+    secmod_signkey.keys
+    |> List.filter (fun k -> Option.is_none k.Signkey.master_sig)
+    |> List.map (mk_future_signkey secmod_signkey.secmod_key.sign)
   in
   let master_pub = Config.Exchange.master_public_key in
-  let denom_secmod_public_key = denom_key.pub in
-  let signkey_secmod_public_key = signkey.pub in
+  let denom_secmod_public_key = secmod_denom.secmod_key.pub in
+  let signkey_secmod_public_key = secmod_signkey.secmod_key.pub in
   FutureKeysResponse.
     {
       future_denoms;
@@ -109,13 +116,9 @@ let mk_future_keys_response ~signkey ~online_key ~denom_key ~denominations =
 let keys req server _env =
   let open Vif.Response in
   let open Syntax in
-  let signkey = Vif.Server.device Devices.signkey server in
-  let online_key = Vif.Server.device Devices.online_key server in
-  let denom_key = Vif.Server.device Devices.denom_key server in
-  let denominations = Vif.Server.device Devices.denominations server in
-  let v =
-    mk_future_keys_response ~signkey ~online_key ~denom_key ~denominations
-  in
+  let secmod_signkey = Vif.Server.device Devices.secmod_signkey server in
+  let secmod_denom = Vif.Server.device Devices.secmod_denom server in
+  let v = mk_future_keys_response secmod_signkey secmod_denom in
   let s = Json.encode_exn Json.FutureKeysResponse.jsont v in
   let* () = with_string req s in
   let* () = add ~field:"content-type" "application/json" in
diff --git a/src/mte.ml b/src/mte.ml
index 7db92651..d4b4a2e2 100644
--- a/src/mte.ml
+++ b/src/mte.ml
@@ -123,6 +123,6 @@ let () =
   in
   Miou_unix.run @@ fun () ->
   let env = () in
-  let devices = Devices.l in
+  let devices = Vif.Devices.[ Devices.secmod_signkey; Devices.secmod_denom ] in
   let middlewares = Vif.Middlewares.[] in
   Vif.run ~cfg ~devices ~middlewares routes env
diff --git a/src/signkey.ml b/src/signkey.ml
index 41b890e6..e7923785 100644
--- a/src/signkey.ml
+++ b/src/signkey.ml
@@ -1,16 +1,15 @@
 open Types
 
 type t = {
+  pub: EddsaPublicKey.t;
   stamp_start: Ptime.t;
   stamp_expire: Ptime.t;
   stamp_end: Ptime.t;
-  pub: EddsaPublicKey.t;
   sign: string -> EddsaSignature.t;
+  master_sig: EddsaSignature.t option;
 }
 
-let make ~name =
-  let finally _key = () in
-  Vif.Device.v ~name ~finally [] @@ fun () ->
+let generate () =
   (* TODO
        - look if it exists
        - if not, create it (TOFU initialization scheme)
@@ -27,4 +26,5 @@ let make ~name =
   let stamp_end = stamp_expire in
   let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
   let sign s = EddsaSignature.sign ~key:priv s in
-  { stamp_start; stamp_expire; stamp_end; pub; sign }
+  let master_sig = None in
+  { pub; stamp_start; stamp_expire; stamp_end; master_sig; sign }