update_user uses .key file exclusively