make crypto more flexible (so enabling ECDSA will be easier when browsers start supporting it) and add a basic server-side key type check
change key fingerprints from SHA-1 to SHA-256, and use bubble-babble
instead of base64