This should all really just be pushed down into the XML parsing, so that the modulestores take care of the key deserialization.