Don't put private keys in the root manifest!