separate sign/verify key