make sure key is only readable by owner