Because those seemed like two discrete things that should happen before tests start running, but also because I'm bad at writing tests.

(the keypair generation will probably get moved up a level when we start adding tests to make sure csrf / mismatch / etc all get caught)