serf: make RWMutex private in keymanager