only update pub key if decrypted