this leaks `key`