client should persist tun/key too