box as a string, fix for appending pubkey