PKI rework

intend fix