move registering scc steps to lib, and check IMPORT_UNTRUSTED_KEY var to decide do we untrust that key or not