make it clearer that the :signing key is first-level