`signing_key`, `encryption_key`, and `backend` should all be private?