API wants "proper" keys.
Use "Vault".
Move signature algorithms into utils.