I'd also prefer a separate key serialization API.  I'm not entirely sure what that looks like though, since it involves 2 backend interfaces that need to be able to share a backend specific private structure.