the private key does not need to be an instance variable
send server domain as "origin" instead of public key