publicKey goes first in the API