run: better CN and perm for keys