public key readable to everyone, private key readable only to puppet