use the admin pubkey, not pair pubkey, for "root stuff"