server/client: keystore pubkeys