Fix: when adding PK, add to Merkle only if key is signed