only look at signing keys, not encryption keys