moved encrypted keys to global