principals now return key data, todo add mask option (only return key data when explicitly requested)