respecting target users when generating otp keys