forgot to checkin updated schema
move valid enrollment key logic to separate helper