use two keypairs (seperate for signing and encryption). combine two stream paths into one.