does it make sense to wait to merge this PR sometime after opaque_keys gets pulled out into its own library? since we'll have to change all these to import from opaque_keys?