#
#
# patch "automate.cc"
#  from [3f693194a9de3cb8e5214dd13608103597a7f737]
#    to [dc4c19cfde7d8fcd0fcff72cb5d886af8aa78886]
# 
# patch "cert.cc"
#  from [d98658ea6742e5a25f6575d923ce0749849713f6]
#    to [0f86b8b9ce6559348a752649626bcaa6cf66d186]
# 
# patch "cert.hh"
#  from [a8a2f7ee562ac6b3685a81e0114fd94651bdec65]
#    to [f8ccd969215542f7a378381007368e5940c1ead3]
# 
# patch "charset.cc"
#  from [cb4c4d6eb72633937e1a4769fdaac437a933e58f]
#    to [2b36a7faf39adc8a87f9720c4ea3cb43e9f679ab]
# 
# patch "charset.hh"
#  from [0cb9234e49ef5ade2ed2a04e9c7f7f0fbcdf6a4a]
#    to [468ace1176734b92da92f322e49e0ff85f967bf0]
# 
# patch "cmd_key_cert.cc"
#  from [54cf94e72318fb08647301be92918e9f94b4e253]
#    to [2bd5467d5e63f2852a6a53be88e04e4f7ebc3f8a]
# 
# patch "cmd_list.cc"
#  from [9bd690b389ab8f218146de800075c97bdce7333f]
#    to [48c1e1bd67b5a41aa5dc47228fdd7b7523a96f2b]
# 
# patch "cmd_netsync.cc"
#  from [daaee53881abbda9c400148f4870098cb03508de]
#    to [089de88c4106d74be847c030ca3967252215b801]
# 
# patch "cmd_packet.cc"
#  from [e519a5ad5cba195c20a6caedd75a165e58d3c08b]
#    to [7143d3fd50efc62b0ebb17d1ef894408ff5d6eeb]
# 
# patch "database.cc"
#  from [29ad223f150112f10bbc9b0769208f0cc8d2913a]
#    to [df78853ee40d81f772459a3cd89abf1fac6667ec]
# 
# patch "database.hh"
#  from [db606c2e07d1b60a50cb8a95118c5a62141c662f]
#    to [87edc8755e0003a5f7d6fe62af6b09f61d04ae77]
# 
# patch "database_check.cc"
#  from [7ac0f3bce63f4ef189137684433ee8658380fd92]
#    to [b0a9902c384be0628ca247149cb88b4e0fc38ed5]
# 
# patch "key_store.cc"
#  from [459dd9ae128419afaaa65dd6bb7d3d725a32f207]
#    to [f56c817070cc757ef30042916ee6d833a0b2f399]
# 
# patch "key_store.hh"
#  from [1f5935e3c1fc3dc4063729c43be2c256c00857f0]
#    to [e2aed4db98d67a50f1412298ef47c9b071a65f41]
# 
# patch "keys.cc"
#  from [95fc131d10d44a59802efd24ade47d2320530036]
#    to [ba36cac0b2f9d3a5ba584c8af6ebb34d84f7e9a1]
# 
# patch "keys.hh"
#  from [6cc9c7d9f206f27bfcef3269694585f0eda7eaa1]
#    to [9046a9b13ca740f916f3a7ec43c63651a49c6d03]
# 
# patch "lua_hooks.cc"
#  from [14c47b49b38e31bc04dd47c1ea5d53231c772f8d]
#    to [b681e7c7207510baa6eb9b33d4740d6122f18488]
# 
# patch "lua_hooks.hh"
#  from [13b02250e084d7e1d04d9df095f4409d3b6189bb]
#    to [07356795d81fbfd324c6261089386e28b77c1b75]
# 
# patch "migrate_schema.cc"
#  from [a53016bd522dc676d9df6767369e5d28bf526868]
#    to [f987fd101b23760fee0b5a5cd21ad955e1d6bc1d]
# 
# patch "netcmd.cc"
#  from [64d6c56e6b3de68bd2e3cf34c3530b5fb14b54d5]
#    to [0c56fd7f8c57093b24b03fad157db98ddd60aed6]
# 
# patch "netcmd.hh"
#  from [9fd97280633714008862a4a261403461d335fed5]
#    to [7ae6803e6f436b4fcf76f26c29a6f1b62234545a]
# 
# patch "netsync.cc"
#  from [9352f59c67d47e16991713015356bc0bc971b863]
#    to [a0c2d1d33f00a3470db30b9a70003e36ef0a69a1]
# 
# patch "options_list.hh"
#  from [fe3b7714d2c58e05d75fefc8d28bbe5935d22051]
#    to [04514511db1d6d12e25f355816b21203822c89b2]
# 
# patch "packet.cc"
#  from [d0dc9d47397f902117459c3d82bd34f100e75d76]
#    to [f092ffd73ce8c46f055fe96f5a25f1566d5bbfc7]
# 
# patch "packet.hh"
#  from [c2de8fab34088703def8bdd9d33ef544bc68e585]
#    to [0a224e6e92f244e2c3e9a5cdb935eb8613d7e85b]
# 
# patch "project.cc"
#  from [a56b3892d2c9cdaa9a1de14bd420ecafe273b9a9]
#    to [ddcb2a90ab0ba89562edd96ce1ea83f9da7b7b82]
# 
# patch "project.hh"
#  from [055d2051d5452036c0934c741f23153eac9c3fcc]
#    to [e2f0f5db26a6d8bbe9214b264aca96b58513fcc8]
# 
# patch "update.cc"
#  from [dba7f76d0acb65a068cac1dddb85f8d50a60304b]
#    to [a67ae873fc4fca77ae07922e0b6869fc837ae550]
# 
# patch "vocab.cc"
#  from [b6008dbf8b209e237952bb90e934f94d6fbca416]
#    to [d132d79afee66989919564bbfceb93f7590d2d37]
# 
# patch "vocab_terms.hh"
#  from [28341d787d1cbaba84a00ab5b176939b0a81e05e]
#    to [bedb85f7daae7ba8565203769aba9e3db3ba25fd]
# 
# patch "work.cc"
#  from [766cbbfd5b78c442ed6fc650846daa55f9d42768]
#    to [d121755f373bba8299dae44edff0f892ffbb4034]
#
============================================================
--- automate.cc	3f693194a9de3cb8e5214dd13608103597a7f737
+++ automate.cc	dc4c19cfde7d8fcd0fcff72cb5d886af8aa78886
@@ -1791,8 +1791,8 @@ CMD_AUTOMATE(genkey, N_("KEYID PASSPHRAS
   database db(app);
   key_store keys(app);
 
-  rsa_keypair_id ident;
-  internalize_rsa_keypair_id(idx(args, 0), ident);
+  key_name ident;
+  internalize_key_name(idx(args, 0), ident);
 
   utf8 passphrase = idx(args, 1);
 
============================================================
--- cert.cc	d98658ea6742e5a25f6575d923ce0749849713f6
+++ cert.cc	0f86b8b9ce6559348a752649626bcaa6cf66d186
@@ -63,7 +63,7 @@ read_cert(string const & in, cert & t)
 
   cert tmp(ident, cert_name(name, origin::network),
            cert_value(val, origin::network),
-           rsa_keypair_id(key, origin::network),
+           key_name(key, origin::network),
            rsa_sha1_signature(sig, origin::network));
 
   id check;
============================================================
--- cert.hh	a8a2f7ee562ac6b3685a81e0114fd94651bdec65
+++ cert.hh	f8ccd969215542f7a378381007368e5940c1ead3
@@ -25,14 +25,14 @@ struct cert : public origin_aware
   cert(revision_id const & ident,
        cert_name const & name,
        cert_value const & value,
-       rsa_keypair_id const & key)
+       key_name const & key)
     : ident(ident), name(name), value(value), key(key)
   {}
 
   cert(revision_id const & ident,
        cert_name const & name,
        cert_value const & value,
-       rsa_keypair_id const & key,
+       key_name const & key,
        rsa_sha1_signature const & sig)
     : ident(ident), name(name), value(value), key(key), sig(sig)
   {}
@@ -44,7 +44,7 @@ struct cert : public origin_aware
   revision_id ident;
   cert_name name;
   cert_value value;
-  rsa_keypair_id key;
+  key_name key;
   rsa_sha1_signature sig;
 
   bool operator<(cert const & other) const;
============================================================
--- charset.cc	cb4c4d6eb72633937e1a4769fdaac437a933e58f
+++ charset.cc	2b36a7faf39adc8a87f9720c4ea3cb43e9f679ab
@@ -372,7 +372,7 @@ void
 }
 
 void
-internalize_rsa_keypair_id(utf8 const & utf, rsa_keypair_id & key)
+internalize_key_name(utf8 const & utf, key_name & key)
 {
   string tmp;
   typedef boost::tokenizer<char_separator<char> >
@@ -393,19 +393,19 @@ internalize_rsa_keypair_id(utf8 const & 
       if (*i == "@")
         in_domain = true;
     }
-  key = rsa_keypair_id(tmp, utf.made_from);
+  key = key_name(tmp, utf.made_from);
 }
 
 void
-internalize_rsa_keypair_id(external const & ext, rsa_keypair_id & key)
+internalize_key_name(external const & ext, key_name & key)
 {
   utf8 utf;
   system_to_utf8(ext, utf);
-  internalize_rsa_keypair_id(utf, key);
+  internalize_key_name(utf, key);
 }
 
 void
-externalize_rsa_keypair_id(rsa_keypair_id const & key, utf8 & utf)
+externalize_key_name(key_name const & key, utf8 & utf)
 {
   string tmp;
   typedef boost::tokenizer<char_separator<char> >
@@ -430,10 +430,10 @@ void
 }
 
 void
-externalize_rsa_keypair_id(rsa_keypair_id const & key, external & ext)
+externalize_key_name(key_name const & key, external & ext)
 {
   utf8 utf;
-  externalize_rsa_keypair_id(key, utf);
+  externalize_key_name(key, utf);
   utf8_to_system_strict(utf, ext);
 }
 
============================================================
--- charset.hh	0cb9234e49ef5ade2ed2a04e9c7f7f0fbcdf6a4a
+++ charset.hh	468ace1176734b92da92f322e49e0ff85f967bf0
@@ -41,10 +41,10 @@ void externalize_cert_name(cert_name con
 void internalize_cert_name(external const & ext, cert_name & c);
 void externalize_cert_name(cert_name const & c, utf8 & utf);
 void externalize_cert_name(cert_name const & c, external & ext);
-void internalize_rsa_keypair_id(utf8 const & utf, rsa_keypair_id & key);
-void internalize_rsa_keypair_id(external const & ext, rsa_keypair_id & key);
-void externalize_rsa_keypair_id(rsa_keypair_id const & key, utf8 & utf);
-void externalize_rsa_keypair_id(rsa_keypair_id const & key, external & ext);
+void internalize_key_name(utf8 const & utf, key_name & key);
+void internalize_key_name(external const & ext, key_name & key);
+void externalize_key_name(key_name const & key, utf8 & utf);
+void externalize_key_name(key_name const & key, external & ext);
 void internalize_var_domain(utf8 const & utf, var_domain & d);
 void internalize_var_domain(external const & ext, var_domain & d);
 void externalize_var_domain(var_domain const & d, utf8 & utf);
============================================================
--- cmd_key_cert.cc	54cf94e72318fb08647301be92918e9f94b4e253
+++ cmd_key_cert.cc	2bd5467d5e63f2852a6a53be88e04e4f7ebc3f8a
@@ -40,8 +40,8 @@ CMD(genkey, "genkey", "", CMD_REF(key_an
   if (args.size() != 1)
     throw usage(execid);
 
-  rsa_keypair_id ident;
-  internalize_rsa_keypair_id(idx(args, 0), ident);
+  key_name ident;
+  internalize_key_name(idx(args, 0), ident);
 
   keys.create_key_pair(db, ident);
 }
@@ -59,7 +59,7 @@ CMD(dropkey, "dropkey", "", CMD_REF(key_
   if (args.size() != 1)
     throw usage(execid);
 
-  rsa_keypair_id ident = typecast_vocab<rsa_keypair_id>(idx(args, 0));
+  key_name ident = typecast_vocab<key_name>(idx(args, 0));
   if (db.database_specified())
     {
       transaction_guard guard(db);
@@ -100,8 +100,8 @@ CMD(passphrase, "passphrase", "", CMD_RE
   if (args.size() != 1)
     throw usage(execid);
 
-  rsa_keypair_id ident;
-  internalize_rsa_keypair_id(idx(args, 0), ident);
+  key_name ident;
+  internalize_key_name(idx(args, 0), ident);
 
   keys.change_key_passphrase(ident);
   P(F("passphrase changed"));
@@ -119,7 +119,7 @@ CMD(ssh_agent_export, "ssh_agent_export"
   if (args.size() > 1)
     throw usage(execid);
 
-  rsa_keypair_id id;
+  key_name id;
   get_user_key(app.opts, app.lua, db, keys, id);
 
   if (args.empty())
@@ -146,7 +146,7 @@ CMD(ssh_agent_add, "ssh_agent_add", "", 
   if (args.size() > 1)
     throw usage(execid);
 
-  rsa_keypair_id id;
+  key_name id;
   get_user_key(app.opts, app.lua, db, keys, id);
   keys.add_key_to_agent(id);
 }
@@ -213,11 +213,11 @@ CMD(trusted, "trusted", "", CMD_REF(key_
 
   cert_value value = typecast_vocab<cert_value>(idx(args, 2));
 
-  set<rsa_keypair_id> signers;
+  set<key_name> signers;
   for (unsigned int i = 3; i != args.size(); ++i)
     {
-      rsa_keypair_id keyid;
-      internalize_rsa_keypair_id(idx(args, i), keyid);
+      key_name keyid;
+      internalize_key_name(idx(args, i), keyid);
       signers.insert(keyid);
     }
 
@@ -229,7 +229,7 @@ CMD(trusted, "trusted", "", CMD_REF(key_
 
   ostringstream all_signers;
   copy(signers.begin(), signers.end(),
-       ostream_iterator<rsa_keypair_id>(all_signers, " "));
+       ostream_iterator<key_name>(all_signers, " "));
 
   cout << (F("if a cert on: %s\n"
             "with key: %s\n"
============================================================
--- cmd_list.cc	9bd690b389ab8f218146de800075c97bdce7333f
+++ cmd_list.cc	48c1e1bd67b5a41aa5dc47228fdd7b7523a96f2b
@@ -77,7 +77,7 @@ CMD(certs, "certs", "", CMD_REF(list), "
     certs.push_back(idx(ts, i));
 
   {
-    set<rsa_keypair_id> checked;
+    set<key_name> checked;
     for (size_t i = 0; i < certs.size(); ++i)
       {
         if (checked.find(idx(certs, i).key) == checked.end() &&
@@ -261,8 +261,8 @@ CMD(keys, "keys", "", CMD_REF(list), "[P
   database db(app);
   key_store keys(app);
 
-  vector<rsa_keypair_id> pubs;
-  vector<rsa_keypair_id> privkeys;
+  vector<key_name> pubs;
+  vector<key_name> privkeys;
   globish pattern("*", origin::internal);
   if (args.size() == 1)
     pattern = globish(idx(args, 0)(), origin::user);
@@ -275,15 +275,15 @@ CMD(keys, "keys", "", CMD_REF(list), "[P
   keys.get_key_ids(pattern, privkeys);
 
   // true if it is in the database, false otherwise
-  map<rsa_keypair_id, bool> pubkeys;
-  for (vector<rsa_keypair_id>::const_iterator i = pubs.begin();
+  map<key_name, bool> pubkeys;
+  for (vector<key_name>::const_iterator i = pubs.begin();
        i != pubs.end(); i++)
     pubkeys[*i] = true;
 
-  set<rsa_keypair_id> bad_keys;
+  set<key_name> bad_keys;
 
   bool all_in_db = true;
-  for (vector<rsa_keypair_id>::const_iterator i = privkeys.begin();
+  for (vector<key_name>::const_iterator i = privkeys.begin();
        i != privkeys.end(); i++)
     {
       if (pubkeys.find(*i) == pubkeys.end())
@@ -306,12 +306,12 @@ CMD(keys, "keys", "", CMD_REF(list), "[P
   if (!pubkeys.empty())
     {
       cout << "\n[public keys]\n";
-      for (map<rsa_keypair_id, bool>::iterator i = pubkeys.begin();
+      for (map<key_name, bool>::iterator i = pubkeys.begin();
            i != pubkeys.end(); i++)
         {
           rsa_pub_key pub_encoded;
           id hash_code;
-          rsa_keypair_id keyid = i->first;
+          key_name keyid = i->first;
           bool indb = i->second;
 
           if (indb)
@@ -337,7 +337,7 @@ CMD(keys, "keys", "", CMD_REF(list), "[P
   if (!privkeys.empty())
     {
       cout << "\n[private keys]\n";
-      for (vector<rsa_keypair_id>::iterator i = privkeys.begin();
+      for (vector<key_name>::iterator i = privkeys.begin();
            i != privkeys.end(); i++)
         {
           keypair kp;
@@ -353,7 +353,7 @@ CMD(keys, "keys", "", CMD_REF(list), "[P
     {
       W(F("Some keys in the database have the same ID as, "
           "but different hashes to, keys in your local key store!"));
-      for (set<rsa_keypair_id>::const_iterator i = bad_keys.begin(); i != bad_keys.end(); i++)
+      for (set<key_name>::const_iterator i = bad_keys.begin(); i != bad_keys.end(); i++)
         {
           W(F("Mismatched Key: %s") % *i);
         }
@@ -688,8 +688,8 @@ CMD_AUTOMATE(keys, "",
   database db(app);
   key_store keys(app);
 
-  vector<rsa_keypair_id> dbkeys;
-  vector<rsa_keypair_id> kskeys;
+  vector<key_name> dbkeys;
+  vector<key_name> kskeys;
   // hash, public_location, private_location
   map<string, boost::tuple<id,
                            vector<string>,
@@ -699,7 +699,7 @@ CMD_AUTOMATE(keys, "",
 
   keys.get_key_ids(kskeys);
 
-  for (vector<rsa_keypair_id>::iterator i = dbkeys.begin();
+  for (vector<key_name>::iterator i = dbkeys.begin();
        i != dbkeys.end(); i++)
     {
       rsa_pub_key pub_encoded;
@@ -710,7 +710,7 @@ CMD_AUTOMATE(keys, "",
       items[(*i)()].get<1>().push_back("database");
     }
 
-  for (vector<rsa_keypair_id>::iterator i = kskeys.begin();
+  for (vector<key_name>::iterator i = kskeys.begin();
        i != kskeys.end(); i++)
     {
       keypair kp;
@@ -797,7 +797,7 @@ CMD_AUTOMATE(certs, N_("REV"),
     certs.push_back(idx(ts, i));
 
   {
-    set<rsa_keypair_id> checked;
+    set<key_name> checked;
     for (size_t i = 0; i < certs.size(); ++i)
       {
         if (checked.find(idx(certs, i).key) == checked.end() &&
@@ -820,9 +820,9 @@ CMD_AUTOMATE(certs, N_("REV"),
       cert_status status = db.check_cert(idx(certs, i));
       cert_value tv = idx(certs, i).value;
       cert_name name = idx(certs, i).name;
-      set<rsa_keypair_id> signers;
+      set<key_name> signers;
 
-      rsa_keypair_id keyid = idx(certs, i).key;
+      key_name keyid = idx(certs, i).key;
       signers.insert(keyid);
 
       bool trusted =
============================================================
--- cmd_netsync.cc	daaee53881abbda9c400148f4870098cb03508de
+++ cmd_netsync.cc	089de88c4106d74be847c030ca3967252215b801
@@ -59,7 +59,7 @@ find_key(options & opts,
   if (!opts.signing_key().empty())
     return;
 
-  rsa_keypair_id key;
+  key_name key;
 
   utf8 host(info.client.unparsed);
   if (!info.client.u.host.empty())
============================================================
--- cmd_packet.cc	e519a5ad5cba195c20a6caedd75a165e58d3c08b
+++ cmd_packet.cc	7143d3fd50efc62b0ebb17d1ef894408ff5d6eeb
@@ -34,7 +34,7 @@ CMD(pubkey, "pubkey", "", CMD_REF(packet
   if (args.size() != 1)
     throw usage(execid);
 
-  rsa_keypair_id ident = typecast_vocab<rsa_keypair_id>(idx(args, 0));
+  key_name ident = typecast_vocab<key_name>(idx(args, 0));
   bool exists(false);
   rsa_pub_key key;
   if (db.database_specified() && db.public_key_exists(ident))
@@ -66,7 +66,7 @@ CMD(privkey, "privkey", "", CMD_REF(pack
   if (args.size() != 1)
     throw usage(execid);
 
-  rsa_keypair_id ident = typecast_vocab<rsa_keypair_id>(idx(args, 0));
+  key_name ident = typecast_vocab<key_name>(idx(args, 0));
   E(keys.key_pair_exists(ident), origin::user,
     F("public and private key '%s' do not exist in keystore")
     % idx(args, 0)());
@@ -124,7 +124,7 @@ namespace
       guard.commit();
     }
 
-    virtual void consume_public_key(rsa_keypair_id const & ident,
+    virtual void consume_public_key(key_name const & ident,
                                     rsa_pub_key const & k)
     {
       transaction_guard guard(db);
@@ -132,13 +132,13 @@ namespace
       guard.commit();
     }
 
-    virtual void consume_key_pair(rsa_keypair_id const & ident,
+    virtual void consume_key_pair(key_name const & ident,
                                   keypair const & kp)
     {
       keys.put_key_pair(ident, kp);
     }
 
-    virtual void consume_old_private_key(rsa_keypair_id const & ident,
+    virtual void consume_old_private_key(key_name const & ident,
                                          old_arc4_rsa_priv_key const & k)
     {
       rsa_pub_key dummy;
============================================================
--- database.cc	29ad223f150112f10bbc9b0769208f0cc8d2913a
+++ database.cc	df78853ee40d81f772459a3cd89abf1fac6667ec
@@ -185,7 +185,7 @@ namespace
   typedef hashmap::hash_map<revision_id, set<revision_id> > parent_id_map;
   typedef hashmap::hash_map<revision_id, rev_height> height_map;
 
-  typedef hashmap::hash_map<rsa_keypair_id,
+  typedef hashmap::hash_map<key_name,
                             pair<shared_ptr<Botan::PK_Verifier>,
                                  shared_ptr<Botan::RSA_PublicKey> >
                             > verifier_cache;
@@ -348,7 +348,7 @@ private:
   //
   // --== Keys ==--
   //
-  void get_keys(string const & table, vector<rsa_keypair_id> & keys);
+  void get_keys(string const & table, vector<key_name> & keys);
 
   // cache of verifiers for public keys
   verifier_cache verifiers;
@@ -2869,7 +2869,7 @@ void
 // crypto key management
 
 void
-database::get_key_ids(vector<rsa_keypair_id> & pubkeys)
+database::get_key_ids(vector<key_name> & pubkeys)
 {
   pubkeys.clear();
   results res;
@@ -2877,12 +2877,12 @@ database::get_key_ids(vector<rsa_keypair
   imp->fetch(res, one_col, any_rows, query("SELECT id FROM public_keys"));
 
   for (size_t i = 0; i < res.size(); ++i)
-    pubkeys.push_back(rsa_keypair_id(res[i][0], origin::database));
+    pubkeys.push_back(key_name(res[i][0], origin::database));
 }
 
 void
 database::get_key_ids(globish const & pattern,
-                      vector<rsa_keypair_id> & pubkeys)
+                      vector<key_name> & pubkeys)
 {
   pubkeys.clear();
   results res;
@@ -2891,21 +2891,21 @@ database::get_key_ids(globish const & pa
 
   for (size_t i = 0; i < res.size(); ++i)
     if (pattern.matches(res[i][0]))
-      pubkeys.push_back(rsa_keypair_id(res[i][0], origin::database));
+      pubkeys.push_back(key_name(res[i][0], origin::database));
 }
 
 void
-database_impl::get_keys(string const & table, vector<rsa_keypair_id> & keys)
+database_impl::get_keys(string const & table, vector<key_name> & keys)
 {
   keys.clear();
   results res;
   fetch(res, one_col, any_rows, query("SELECT id FROM " + table));
   for (size_t i = 0; i < res.size(); ++i)
-    keys.push_back(rsa_keypair_id(res[i][0], origin::database));
+    keys.push_back(key_name(res[i][0], origin::database));
 }
 
 void
-database::get_public_keys(vector<rsa_keypair_id> & keys)
+database::get_public_keys(vector<key_name> & keys)
 {
   imp->get_keys("public_keys", keys);
 }
@@ -2924,7 +2924,7 @@ bool
 }
 
 bool
-database::public_key_exists(rsa_keypair_id const & id)
+database::public_key_exists(key_name const & id)
 {
   results res;
   imp->fetch(res, one_col, any_rows,
@@ -2938,19 +2938,19 @@ database::get_pubkey(id const & hash,
 
 void
 database::get_pubkey(id const & hash,
-                     rsa_keypair_id & id,
+                     key_name & id,
                      rsa_pub_key & pub)
 {
   results res;
   imp->fetch(res, 2, one_row,
              query("SELECT id, keydata FROM public_keys WHERE hash = ?")
              % blob(hash()));
-  id = rsa_keypair_id(res[0][0], origin::database);
+  id = key_name(res[0][0], origin::database);
   pub = rsa_pub_key(res[0][1], origin::database);
 }
 
 void
-database::get_key(rsa_keypair_id const & pub_id,
+database::get_key(key_name const & pub_id,
                   rsa_pub_key & pub)
 {
   results res;
@@ -2961,7 +2961,7 @@ bool
 }
 
 bool
-database::put_key(rsa_keypair_id const & pub_id,
+database::put_key(key_name const & pub_id,
                   rsa_pub_key const & pub)
 {
   if (public_key_exists(pub_id))
@@ -2989,14 +2989,14 @@ void
 }
 
 void
-database::delete_public_key(rsa_keypair_id const & pub_id)
+database::delete_public_key(key_name const & pub_id)
 {
   imp->execute(query("DELETE FROM public_keys WHERE id = ?")
                % text(pub_id()));
 }
 
 void
-database::encrypt_rsa(rsa_keypair_id const & pub_id,
+database::encrypt_rsa(key_name const & pub_id,
                       string const & plaintext,
                       rsa_oaep_sha_data & ciphertext)
 {
@@ -3034,7 +3034,7 @@ cert_status
 }
 
 cert_status
-database::check_signature(rsa_keypair_id const & id,
+database::check_signature(key_name const & id,
                           string const & alleged_text,
                           rsa_sha1_signature const & signature)
 {
@@ -3148,7 +3148,7 @@ database_impl::results_to_certs(results 
       t = cert(revision_id(res[i][0], origin::database),
                cert_name(res[i][1], origin::database),
                cert_value(res[i][2], origin::database),
-               rsa_keypair_id(res[i][3], origin::database),
+               key_name(res[i][3], origin::database),
                rsa_sha1_signature(res[i][4], origin::database));
       certs.push_back(t);
     }
@@ -3294,7 +3294,7 @@ database::get_revision_cert_nobranch_ind
 
 outdated_indicator
 database::get_revision_cert_nobranch_index(vector< pair<revision_id,
-                                           pair<revision_id, rsa_keypair_id> > > & idx)
+                                           pair<revision_id, key_name> > > & idx)
 {
   // share some storage
   id::symtab id_syms;
@@ -3310,7 +3310,7 @@ database::get_revision_cert_nobranch_ind
     {
       idx.push_back(make_pair(revision_id((*i)[0], origin::database),
                               make_pair(revision_id((*i)[1], origin::database),
-                                        rsa_keypair_id((*i)[2], origin::database))));
+                                        key_name((*i)[2], origin::database))));
     }
   return imp->cert_stamper.get_indicator();
 }
@@ -3475,7 +3475,7 @@ namespace {
     // sorry, this is a crazy data structure
     typedef tuple<id, cert_name, cert_value> trust_key;
     typedef map< trust_key,
-      pair< shared_ptr< set<rsa_keypair_id> >, it > > trust_map;
+      pair< shared_ptr< set<key_name> >, it > > trust_map;
     trust_map trust;
 
     for (it i = certs.begin(); i != certs.end(); ++i)
@@ -3484,10 +3484,10 @@ namespace {
                                   i->name,
                                   i->value);
         trust_map::iterator j = trust.find(key);
-        shared_ptr< set<rsa_keypair_id> > s;
+        shared_ptr< set<key_name> > s;
         if (j == trust.end())
           {
-            s.reset(new set<rsa_keypair_id>());
+            s.reset(new set<key_name>());
             trust.insert(make_pair(key, make_pair(s, i)));
           }
         else
============================================================
--- database.hh	db606c2e07d1b60a50cb8a95118c5a62141c662f
+++ database.hh	87edc8755e0003a5f7d6fe62af6b09f61d04ae77
@@ -230,31 +230,31 @@ public:
   // --== Keys ==--
   //
 public:
-  void get_key_ids(std::vector<rsa_keypair_id> & pubkeys);
+  void get_key_ids(std::vector<key_name> & pubkeys);
   void get_key_ids(globish const & pattern,
-                   std::vector<rsa_keypair_id> & pubkeys);
+                   std::vector<key_name> & pubkeys);
 
-  void get_public_keys(std::vector<rsa_keypair_id> & pubkeys);
+  void get_public_keys(std::vector<key_name> & pubkeys);
 
   bool public_key_exists(id const & hash);
-  bool public_key_exists(rsa_keypair_id const & ident);
+  bool public_key_exists(key_name const & ident);
 
   void get_pubkey(id const & hash,
-                  rsa_keypair_id & ident,
+                  key_name & ident,
                   rsa_pub_key & pub);
 
-  void get_key(rsa_keypair_id const & ident, rsa_pub_key & pub);
-  bool put_key(rsa_keypair_id const & ident, rsa_pub_key const & pub);
+  void get_key(key_name const & ident, rsa_pub_key & pub);
+  bool put_key(key_name const & ident, rsa_pub_key const & pub);
 
-  void delete_public_key(rsa_keypair_id const & pub_id);
+  void delete_public_key(key_name const & pub_id);
 
   // Crypto operations
 
-  void encrypt_rsa(rsa_keypair_id const & pub_id,
+  void encrypt_rsa(key_name const & pub_id,
                    std::string const & plaintext,
                    rsa_oaep_sha_data & ciphertext);
 
-  cert_status check_signature(rsa_keypair_id const & id,
+  cert_status check_signature(key_name const & id,
                               std::string const & alleged_text,
                               rsa_sha1_signature const & signature);
   cert_status check_cert(cert const & t);
@@ -271,7 +271,7 @@ public:
 
   // this variant has to be rather coarse and fast, for netsync's use
   outdated_indicator get_revision_cert_nobranch_index(std::vector< std::pair<revision_id,
-                              std::pair<revision_id, rsa_keypair_id> > > & idx);
+                              std::pair<revision_id, key_name> > > & idx);
 
   // Only used by database_check.cc
   outdated_indicator get_revision_certs(std::vector<cert> & certs);
@@ -310,7 +310,7 @@ public:
 
   void get_revision_cert(id const & hash, cert & c);
 
-  typedef boost::function<bool(std::set<rsa_keypair_id> const &,
+  typedef boost::function<bool(std::set<key_name> const &,
                                id const &,
                                cert_name const &,
                                cert_value const &)> cert_trust_checker;
============================================================
--- database_check.cc	7ac0f3bce63f4ef189137684433ee8658380fd92
+++ database_check.cc	b0a9902c384be0628ca247149cb88b4e0fc38ed5
@@ -432,9 +432,9 @@ check_keys(database & db,
 
 static void
 check_keys(database & db,
-           map<rsa_keypair_id, checked_key> & checked_keys)
+           map<key_name, checked_key> & checked_keys)
 {
-  vector<rsa_keypair_id> pubkeys;
+  vector<key_name> pubkeys;
 
   db.get_public_keys(pubkeys);
 
@@ -442,7 +442,7 @@ check_keys(database & db,
 
   ticker ticks(_("keys"), "k", 1);
 
-  for (vector<rsa_keypair_id>::const_iterator i = pubkeys.begin();
+  for (vector<key_name>::const_iterator i = pubkeys.begin();
        i != pubkeys.end(); ++i)
     {
       db.get_key(*i, checked_keys[*i].pub);
@@ -455,7 +455,7 @@ check_certs(database & db,
 static void
 check_certs(database & db,
             map<revision_id, checked_revision> & checked_revisions,
-            map<rsa_keypair_id, checked_key> & checked_keys,
+            map<key_name, checked_key> & checked_keys,
             size_t & total_certs)
 {
   vector<cert> certs;
@@ -763,10 +763,10 @@ static void
 }
 
 static void
-report_keys(map<rsa_keypair_id, checked_key> const & checked_keys,
+report_keys(map<key_name, checked_key> const & checked_keys,
             size_t & missing_keys)
 {
-  for (map<rsa_keypair_id, checked_key>::const_iterator
+  for (map<key_name, checked_key>::const_iterator
          i = checked_keys.begin(); i != checked_keys.end(); ++i)
     {
       checked_key key = i->second;
@@ -898,7 +898,7 @@ check_db(database & db)
   set<manifest_id> found_manifests;
   map<revision_id, checked_roster> checked_rosters;
   map<revision_id, checked_revision> checked_revisions;
-  map<rsa_keypair_id, checked_key> checked_keys;
+  map<key_name, checked_key> checked_keys;
   map<revision_id, checked_height> checked_heights;
 
   size_t missing_files = 0;
============================================================
--- key_store.cc	459dd9ae128419afaaa65dd6bb7d3d725a32f207
+++ key_store.cc	f56c817070cc757ef30042916ee6d833a0b2f399
@@ -59,16 +59,16 @@ struct key_store_state
   string const ssh_sign_mode;
   bool have_read;
   lua_hooks & lua;
-  map<rsa_keypair_id, keypair> keys;
-  map<id, rsa_keypair_id> hashes;
+  map<key_name, keypair> keys;
+  map<id, key_name> hashes;
 
 #if BOTAN_VERSION_CODE >= BOTAN_VERSION_CODE_FOR(1,7,7)
   boost::shared_ptr<lazy_rng> rng;
 #endif
 
   // These are used to cache keys and signers (if the hook allows).
-  map<rsa_keypair_id, shared_ptr<RSA_PrivateKey> > privkey_cache;
-  map<rsa_keypair_id, shared_ptr<PK_Signer> > signer_cache;
+  map<key_name, shared_ptr<RSA_PrivateKey> > privkey_cache;
+  map<key_name, shared_ptr<PK_Signer> > signer_cache;
 
   // Initialized when first required.
   scoped_ptr<ssh_agent> agent;
@@ -89,15 +89,15 @@ struct key_store_state
   }
 
   // internal methods
-  void get_key_file(rsa_keypair_id const & ident, system_path & file);
-  void write_key(rsa_keypair_id const & ident, keypair const & kp);
+  void get_key_file(key_name const & ident, system_path & file);
+  void write_key(key_name const & ident, keypair const & kp);
   void maybe_read_key_dir();
-  shared_ptr<RSA_PrivateKey> decrypt_private_key(rsa_keypair_id const & id,
+  shared_ptr<RSA_PrivateKey> decrypt_private_key(key_name const & id,
                                                  bool force_from_user = false);
 
   // just like put_key_pair except that the key is _not_ written to disk.
   // for internal use in reading keys back from disk.
-  bool put_key_pair_memory(rsa_keypair_id const & ident,
+  bool put_key_pair_memory(key_name const & ident,
                            keypair const & kp);
 
   // wrapper around accesses to agent, initializes as needed
@@ -110,11 +110,11 @@ struct key_store_state
 
   // duplicates of key_store interfaces for use by key_store_state methods
   // and the keyreader.
-  bool maybe_get_key_pair(rsa_keypair_id const & ident,
+  bool maybe_get_key_pair(key_name const & ident,
                           keypair & kp);
-  bool put_key_pair(rsa_keypair_id const & ident,
+  bool put_key_pair(key_name const & ident,
                     keypair const & kp);
-  void migrate_old_key_pair(rsa_keypair_id const & id,
+  void migrate_old_key_pair(key_name const & id,
                             old_arc4_rsa_priv_key const & old_priv,
                             rsa_pub_key const & pub);
 };
@@ -141,11 +141,11 @@ namespace
     {E(false, origin::system, F("Extraneous data in key store."));}
 
 
-    virtual void consume_public_key(rsa_keypair_id const & ident,
+    virtual void consume_public_key(key_name const & ident,
                                     rsa_pub_key const & k)
     {E(false, origin::system, F("Extraneous data in key store."));}
 
-    virtual void consume_key_pair(rsa_keypair_id const & ident,
+    virtual void consume_key_pair(key_name const & ident,
                                   keypair const & kp)
     {
       L(FL("reading key pair '%s' from key store") % ident);
@@ -157,7 +157,7 @@ namespace
     }
 
     // for backward compatibility
-    virtual void consume_old_private_key(rsa_keypair_id const & ident,
+    virtual void consume_old_private_key(key_name const & ident,
                                          old_arc4_rsa_priv_key const & k)
     {
       W(F("converting old-format private key '%s'") % ident);
@@ -224,39 +224,39 @@ key_store::get_key_ids(globish const & p
 
 void
 key_store::get_key_ids(globish const & pattern,
-                       vector<rsa_keypair_id> & priv)
+                       vector<key_name> & priv)
 {
   s->maybe_read_key_dir();
   priv.clear();
-  for (map<rsa_keypair_id, keypair>::const_iterator
+  for (map<key_name, keypair>::const_iterator
          i = s->keys.begin(); i != s->keys.end(); ++i)
     if (pattern.matches((i->first)()))
       priv.push_back(i->first);
 }
 
 void
-key_store::get_key_ids(vector<rsa_keypair_id> & priv)
+key_store::get_key_ids(vector<key_name> & priv)
 {
   s->maybe_read_key_dir();
   priv.clear();
-  for (map<rsa_keypair_id, keypair>::const_iterator
+  for (map<key_name, keypair>::const_iterator
          i = s->keys.begin(); i != s->keys.end(); ++i)
     priv.push_back(i->first);
 }
 
 bool
-key_store::key_pair_exists(rsa_keypair_id const & ident)
+key_store::key_pair_exists(key_name const & ident)
 {
   s->maybe_read_key_dir();
   return s->keys.find(ident) != s->keys.end();
 }
 
 bool
-key_store_state::maybe_get_key_pair(rsa_keypair_id const & ident,
+key_store_state::maybe_get_key_pair(key_name const & ident,
                                     keypair & kp)
 {
   maybe_read_key_dir();
-  map<rsa_keypair_id, keypair>::const_iterator i = keys.find(ident);
+  map<key_name, keypair>::const_iterator i = keys.find(ident);
   if (i == keys.end())
     return false;
   kp = i->second;
@@ -264,14 +264,14 @@ bool
 }
 
 bool
-key_store::maybe_get_key_pair(rsa_keypair_id const & ident,
+key_store::maybe_get_key_pair(key_name const & ident,
                               keypair & kp)
 {
   return s->maybe_get_key_pair(ident, kp);
 }
 
 void
-key_store::get_key_pair(rsa_keypair_id const & ident,
+key_store::get_key_pair(key_name const & ident,
                         keypair & kp)
 {
   bool found = maybe_get_key_pair(ident, kp);
@@ -280,15 +280,15 @@ key_store::maybe_get_key_pair(id const &
 
 bool
 key_store::maybe_get_key_pair(id const & hash,
-                              rsa_keypair_id & keyid,
+                              key_name & keyid,
                               keypair & kp)
 {
   s->maybe_read_key_dir();
-  map<id, rsa_keypair_id>::const_iterator hi = s->hashes.find(hash);
+  map<id, key_name>::const_iterator hi = s->hashes.find(hash);
   if (hi == s->hashes.end())
     return false;
 
-  map<rsa_keypair_id, keypair>::const_iterator ki = s->keys.find(hi->second);
+  map<key_name, keypair>::const_iterator ki = s->keys.find(hi->second);
   if (ki == s->keys.end())
     return false;
   keyid = hi->second;
@@ -297,7 +297,7 @@ void
 }
 
 void
-key_store_state::get_key_file(rsa_keypair_id const & ident,
+key_store_state::get_key_file(key_name const & ident,
                               system_path & file)
 {
   // filename is the keypair id, except that some characters can't be put in
@@ -311,7 +311,7 @@ void
 }
 
 void
-key_store_state::write_key(rsa_keypair_id const & ident,
+key_store_state::write_key(key_name const & ident,
                            keypair const & kp)
 {
   ostringstream oss;
@@ -328,7 +328,7 @@ bool
 }
 
 bool
-key_store_state::put_key_pair(rsa_keypair_id const & ident,
+key_store_state::put_key_pair(key_name const & ident,
                               keypair const & kp)
 {
   maybe_read_key_dir();
@@ -339,18 +339,18 @@ bool
 }
 
 bool
-key_store::put_key_pair(rsa_keypair_id const & ident,
+key_store::put_key_pair(key_name const & ident,
                         keypair const & kp)
 {
   return s->put_key_pair(ident, kp);
 }
 
 bool
-key_store_state::put_key_pair_memory(rsa_keypair_id const & ident,
+key_store_state::put_key_pair_memory(key_name const & ident,
                                      keypair const & kp)
 {
   L(FL("putting key pair '%s'") % ident);
-  pair<map<rsa_keypair_id, keypair>::iterator, bool> res;
+  pair<map<key_name, keypair>::iterator, bool> res;
   res = keys.insert(make_pair(ident, kp));
   if (res.second)
     {
@@ -371,15 +371,15 @@ void
 }
 
 void
-key_store::delete_key(rsa_keypair_id const & ident)
+key_store::delete_key(key_name const & ident)
 {
   s->maybe_read_key_dir();
-  map<rsa_keypair_id, keypair>::iterator i = s->keys.find(ident);
+  map<key_name, keypair>::iterator i = s->keys.find(ident);
   if (i != s->keys.end())
     {
       id hash;
       key_hash_code(ident, i->second.pub, hash);
-      map<id, rsa_keypair_id>::iterator j = s->hashes.find(hash);
+      map<id, key_name>::iterator j = s->hashes.find(hash);
       I(j != s->hashes.end());
       s->hashes.erase(j);
       s->keys.erase(i);
@@ -401,7 +401,7 @@ get_passphrase(utf8 & phrase,
 // match.  Prompts are worded slightly differently if GENERATING_KEY is true.
 static void
 get_passphrase(utf8 & phrase,
-               rsa_keypair_id const & keyid,
+               key_name const & keyid,
                bool confirm_phrase,
                bool generating_key)
 {
@@ -455,11 +455,11 @@ shared_ptr<RSA_PrivateKey>
 
 
 shared_ptr<RSA_PrivateKey>
-key_store_state::decrypt_private_key(rsa_keypair_id const & id,
+key_store_state::decrypt_private_key(key_name const & id,
                                      bool force_from_user)
 {
   // See if we have this key in the decrypted key cache.
-  map<rsa_keypair_id, shared_ptr<RSA_PrivateKey> >::const_iterator
+  map<key_name, shared_ptr<RSA_PrivateKey> >::const_iterator
     cpk = privkey_cache.find(id);
   if (cpk != privkey_cache.end())
     return cpk->second;
@@ -533,7 +533,7 @@ void
 }
 
 void
-key_store::cache_decrypted_key(const rsa_keypair_id & id)
+key_store::cache_decrypted_key(const key_name & id)
 {
   signing_key = id;
   keypair key;
@@ -550,7 +550,7 @@ key_store::create_key_pair(database & db
 
 void
 key_store::create_key_pair(database & db,
-                           rsa_keypair_id const & ident,
+                           key_name const & ident,
                            utf8 const * maybe_passphrase,
                            id * maybe_hash)
 {
@@ -628,7 +628,7 @@ void
 }
 
 void
-key_store::change_key_passphrase(rsa_keypair_id const & id)
+key_store::change_key_passphrase(key_name const & id)
 {
   keypair kp;
   load_key_pair(*this, id, kp);
@@ -654,7 +654,7 @@ void
 }
 
 void
-key_store::decrypt_rsa(rsa_keypair_id const & id,
+key_store::decrypt_rsa(key_name const & id,
                        rsa_oaep_sha_data const & ciphertext,
                        string & plaintext)
 {
@@ -682,7 +682,7 @@ key_store::make_signature(database & db,
 
 void
 key_store::make_signature(database & db,
-                          rsa_keypair_id const & id,
+                          key_name const & id,
                           string const & tosign,
                           rsa_sha1_signature & signature)
 {
@@ -806,7 +806,7 @@ void
 //
 
 void
-key_store::add_key_to_agent(rsa_keypair_id const & id)
+key_store::add_key_to_agent(key_name const & id)
 {
   ssh_agent & agent = s->get_agent();
   E(agent.connected(), origin::user,
@@ -817,7 +817,7 @@ void
 }
 
 void
-key_store::export_key_for_agent(rsa_keypair_id const & id,
+key_store::export_key_for_agent(key_name const & id,
                                 std::ostream & os)
 {
   shared_ptr<RSA_PrivateKey> priv = s->decrypt_private_key(id);
@@ -847,7 +847,7 @@ key_store_state::migrate_old_key_pair
 
 void
 key_store_state::migrate_old_key_pair
-    (rsa_keypair_id const & id,
+    (key_name const & id,
      old_arc4_rsa_priv_key const & old_priv,
      rsa_pub_key const & pub)
 {
@@ -938,7 +938,7 @@ key_store::migrate_old_key_pair
 
 void
 key_store::migrate_old_key_pair
-    (rsa_keypair_id const & id,
+    (key_name const & id,
      old_arc4_rsa_priv_key const & old_priv,
      rsa_pub_key const & pub)
 {
============================================================
--- key_store.hh	1f5935e3c1fc3dc4063729c43be2c256c00857f0
+++ key_store.hh	e2aed4db98d67a50f1412298ef47c9b071a65f41
@@ -47,7 +47,7 @@ public:
   boost::scoped_ptr<key_store_state> s;
 
 public:
-  rsa_keypair_id signing_key;
+  key_name signing_key;
 
   explicit key_store(app_state & a);
   ~key_store();
@@ -60,52 +60,52 @@ public:
 
   // Basic key I/O
 
-  void get_key_ids(std::vector<rsa_keypair_id> & priv);
+  void get_key_ids(std::vector<key_name> & priv);
   void get_key_ids(globish const & pattern,
-                   std::vector<rsa_keypair_id> & priv);
+                   std::vector<key_name> & priv);
 
-  bool key_pair_exists(rsa_keypair_id const & ident);
+  bool key_pair_exists(key_name const & ident);
 
-  void get_key_pair(rsa_keypair_id const & ident,
+  void get_key_pair(key_name const & ident,
                     keypair & kp);
-  bool maybe_get_key_pair(rsa_keypair_id const & ident,
+  bool maybe_get_key_pair(key_name const & ident,
                           keypair & kp);
   bool maybe_get_key_pair(id const & hash,
-                          rsa_keypair_id & ident,
+                          key_name & ident,
                           keypair & kp);
 
-  bool put_key_pair(rsa_keypair_id const & ident,
+  bool put_key_pair(key_name const & ident,
                     keypair const & kp);
 
-  void delete_key(rsa_keypair_id const & ident);
+  void delete_key(key_name const & ident);
 
   // Crypto operations
 
-  void cache_decrypted_key(rsa_keypair_id const & id);
+  void cache_decrypted_key(key_name const & id);
 
-  void create_key_pair(database & db, rsa_keypair_id const & ident,
+  void create_key_pair(database & db, key_name const & ident,
                        utf8 const * maybe_passphrase = NULL,
                        id * maybe_hash = NULL);
 
-  void change_key_passphrase(rsa_keypair_id const & id);
+  void change_key_passphrase(key_name const & id);
 
-  void decrypt_rsa(rsa_keypair_id const & id,
+  void decrypt_rsa(key_name const & id,
                    rsa_oaep_sha_data const & ciphertext,
                    std::string & plaintext);
 
-  void make_signature(database & db, rsa_keypair_id const & id,
+  void make_signature(database & db, key_name const & id,
                       std::string const & tosign,
                       rsa_sha1_signature & signature);
 
   // Interoperation with ssh-agent
 
-  void add_key_to_agent(rsa_keypair_id const & id);
-  void export_key_for_agent(rsa_keypair_id const & id,
+  void add_key_to_agent(key_name const & id);
+  void export_key_for_agent(key_name const & id,
                             std::ostream & os);
 
   // Migration from old databases
 
-  void migrate_old_key_pair(rsa_keypair_id const & id,
+  void migrate_old_key_pair(key_name const & id,
                             old_arc4_rsa_priv_key const & old_priv,
                             rsa_pub_key const & pub);
 };
============================================================
--- keys.cc	95fc131d10d44a59802efd24ade47d2320530036
+++ keys.cc	ba36cac0b2f9d3a5ba584c8af6ebb34d84f7e9a1
@@ -33,7 +33,7 @@ void
 // if that key pair is not available.
 
 void
-load_key_pair(key_store & keys, rsa_keypair_id const & id)
+load_key_pair(key_store & keys, key_name const & id)
 {
   E(keys.key_pair_exists(id), origin::user,
     F("no key pair '%s' found in key store '%s'")
@@ -42,7 +42,7 @@ load_key_pair(key_store & keys,
 
 void
 load_key_pair(key_store & keys,
-              rsa_keypair_id const & id,
+              key_name const & id,
               keypair & kp)
 {
   load_key_pair(keys, id);
@@ -55,7 +55,7 @@ get_user_key(options const & opts, lua_h
 
 void
 get_user_key(options const & opts, lua_hooks & lua,
-             database & db, key_store & keys, rsa_keypair_id & key)
+             database & db, key_store & keys, key_name & key)
 {
   if (!keys.signing_key().empty())
     {
@@ -69,7 +69,7 @@ get_user_key(options const & opts, lua_h
     ; // the lua hook sets the key
   else
     {
-      vector<rsa_keypair_id> all_privkeys;
+      vector<key_name> all_privkeys;
       keys.get_key_ids(all_privkeys);
       E(!all_privkeys.empty(), origin::user,
         F("you have no private key to make signatures with\n"
@@ -112,12 +112,12 @@ cache_user_key(options const & opts, lua
 cache_user_key(options const & opts, lua_hooks & lua,
                database & db, key_store & keys)
 {
-  rsa_keypair_id key;
+  key_name key;
   get_user_key(opts, lua, db, keys, key);
 }
 
 void
-key_hash_code(rsa_keypair_id const & ident,
+key_hash_code(key_name const & ident,
               rsa_pub_key const & pub,
               id & out)
 {
@@ -129,9 +129,9 @@ bool
 // helper to compare if two keys have the same hash
 // (ie are the same key)
 bool
-keys_match(rsa_keypair_id const & id1,
+keys_match(key_name const & id1,
            rsa_pub_key const & key1,
-           rsa_keypair_id const & id2,
+           key_name const & id2,
            rsa_pub_key const & key2)
 {
   id hash1, hash2;
============================================================
--- keys.hh	6cc9c7d9f206f27bfcef3269694585f0eda7eaa1
+++ keys.hh	9046a9b13ca740f916f3a7ec43c63651a49c6d03
@@ -26,27 +26,27 @@ void get_user_key(options const & opts, 
 // N()'s out if there is no unique key for us to use
 void get_user_key(options const & opts, lua_hooks & lua,
                   database & db, key_store & keys,
-                  rsa_keypair_id & key);
+                  key_name & key);
 
 void cache_user_key(options const & opts, lua_hooks & lua,
                     database & db, key_store & keys);
 
 void load_key_pair(key_store & keys,
-                   rsa_keypair_id const & id);
+                   key_name const & id);
 
 void load_key_pair(key_store & keys,
-                   rsa_keypair_id const & id,
+                   key_name const & id,
                    keypair & kp);
 
 // netsync stuff
 
-void key_hash_code(rsa_keypair_id const & ident,
+void key_hash_code(key_name const & ident,
                    rsa_pub_key const & pub,
                    id & out);
 
-bool keys_match(rsa_keypair_id const & id1,
+bool keys_match(key_name const & id1,
                 rsa_pub_key const & key1,
-                rsa_keypair_id const & id2,
+                key_name const & id2,
                 rsa_pub_key const & key2);
 
 #endif // __KEYS_HH__
============================================================
--- lua_hooks.cc	14c47b49b38e31bc04dd47c1ea5d53231c772f8d
+++ lua_hooks.cc	b681e7c7207510baa6eb9b33d4740d6122f18488
@@ -229,7 +229,7 @@ bool
 // nb: if you're hooking lua to return your passphrase, you don't care if we
 // keep a couple extra temporaries of your passphrase around.
 bool
-lua_hooks::hook_get_passphrase(rsa_keypair_id const & k, string & phrase)
+lua_hooks::hook_get_passphrase(key_name const & k, string & phrase)
 {
   return Lua(st)
     .func("get_passphrase")
@@ -279,7 +279,7 @@ lua_hooks::hook_get_branch_key(branch_na
 
 bool
 lua_hooks::hook_get_branch_key(branch_name const & branchname,
-                               rsa_keypair_id & k)
+                               key_name & k)
 {
   string key;
   bool ok = Lua(st)
@@ -289,13 +289,13 @@ lua_hooks::hook_get_branch_key(branch_na
     .extract_str(key)
     .ok();
 
-  k = rsa_keypair_id(key, origin::user);
+  k = key_name(key, origin::user);
   return ok;
 }
 
 bool
 lua_hooks::hook_get_author(branch_name const & branchname,
-                           rsa_keypair_id const & k,
+                           key_name const & k,
                            string & author)
 {
   return Lua(st)
@@ -352,7 +352,7 @@ shared_trust_function_body(Lua & ll,
 
 static inline bool
 shared_trust_function_body(Lua & ll,
-                           set<rsa_keypair_id> const & signers,
+                           set<key_name> const & signers,
                            id const & hash,
                            cert_name const & name,
                            cert_value const & val)
@@ -360,7 +360,7 @@ shared_trust_function_body(Lua & ll,
   ll.push_table();
 
   int k = 1;
-  for (set<rsa_keypair_id>::const_iterator v = signers.begin();
+  for (set<key_name>::const_iterator v = signers.begin();
        v != signers.end(); ++v)
     {
       ll.push_int(k);
@@ -383,7 +383,7 @@ bool
 }
 
 bool
-lua_hooks::hook_get_revision_cert_trust(set<rsa_keypair_id> const & signers,
+lua_hooks::hook_get_revision_cert_trust(set<key_name> const & signers,
                                        id const & hash,
                                        cert_name const & name,
                                        cert_value const & val)
@@ -394,7 +394,7 @@ bool
 }
 
 bool
-lua_hooks::hook_get_manifest_cert_trust(set<rsa_keypair_id> const & signers,
+lua_hooks::hook_get_manifest_cert_trust(set<key_name> const & signers,
                                         id const & hash,
                                         cert_name const & name,
                                         cert_value const & val)
@@ -405,15 +405,15 @@ bool
 }
 
 bool
-lua_hooks::hook_accept_testresult_change(map<rsa_keypair_id, bool> const & old_results,
-                                         map<rsa_keypair_id, bool> const & new_results)
+lua_hooks::hook_accept_testresult_change(map<key_name, bool> const & old_results,
+                                         map<key_name, bool> const & new_results)
 {
   Lua ll(st);
   ll
     .func("accept_testresult_change")
     .push_table();
 
-  for (map<rsa_keypair_id, bool>::const_iterator i = old_results.begin();
+  for (map<key_name, bool>::const_iterator i = old_results.begin();
        i != old_results.end(); ++i)
     {
       ll.push_str(i->first());
@@ -423,7 +423,7 @@ lua_hooks::hook_accept_testresult_change
 
   ll.push_table();
 
-  for (map<rsa_keypair_id, bool>::const_iterator i = new_results.begin();
+  for (map<key_name, bool>::const_iterator i = new_results.begin();
        i != new_results.end(); ++i)
     {
       ll.push_str(i->first());
@@ -595,7 +595,7 @@ lua_hooks::hook_get_netsync_key(utf8 con
 lua_hooks::hook_get_netsync_key(utf8 const & server_address,
                                 globish const & include,
                                 globish const & exclude,
-                                rsa_keypair_id & k)
+                                key_name & k)
 {
   string key_id;
   bool exec_ok
@@ -610,7 +610,7 @@ lua_hooks::hook_get_netsync_key(utf8 con
 
   if (!exec_ok)
     key_id = "";
-  k = rsa_keypair_id(key_id, origin::user);
+  k = key_name(key_id, origin::user);
   return exec_ok;
 }
 
@@ -737,7 +737,7 @@ lua_hooks::hook_get_netsync_read_permitt
 
 bool
 lua_hooks::hook_get_netsync_read_permitted(string const & branch,
-                                           rsa_keypair_id const & identity)
+                                           key_name const & identity)
 {
   bool permitted = false, exec_ok = false;
 
@@ -770,7 +770,7 @@ bool
 }
 
 bool
-lua_hooks::hook_get_netsync_write_permitted(rsa_keypair_id const & identity)
+lua_hooks::hook_get_netsync_write_permitted(key_name const & identity)
 {
   bool permitted = false, exec_ok = false;
 
@@ -903,7 +903,7 @@ lua_hooks::hook_note_netsync_start(size_
 bool
 lua_hooks::hook_note_netsync_start(size_t session_id, string my_role,
                                    int sync_type, string remote_host,
-                                   rsa_keypair_id remote_keyname,
+                                   key_name remote_keyname,
                                    globish include_pattern,
                                    globish exclude_pattern)
 {
@@ -940,7 +940,7 @@ lua_hooks::hook_note_netsync_revision_re
 bool
 lua_hooks::hook_note_netsync_revision_received(revision_id const & new_id,
                                                revision_data const & rdat,
-                                               set<pair<rsa_keypair_id,
+                                               set<pair<key_name,
                                                pair<cert_name,
                                                cert_value> > > const & certs,
                                                size_t session_id)
@@ -953,7 +953,7 @@ lua_hooks::hook_note_netsync_revision_re
 
   ll.push_table();
 
-  typedef set<pair<rsa_keypair_id, pair<cert_name, cert_value> > > cdat;
+  typedef set<pair<key_name, pair<cert_name, cert_value> > > cdat;
 
   int n = 1;
   for (cdat::const_iterator i = certs.begin(); i != certs.end(); ++i)
@@ -977,7 +977,7 @@ lua_hooks::hook_note_netsync_revision_se
 bool
 lua_hooks::hook_note_netsync_revision_sent(revision_id const & new_id,
                                            revision_data const & rdat,
-                                           set<pair<rsa_keypair_id,
+                                           set<pair<key_name,
                                            pair<cert_name,
                                            cert_value> > > const & certs,
                                            size_t session_id)
@@ -990,7 +990,7 @@ lua_hooks::hook_note_netsync_revision_se
 
   ll.push_table();
 
-  typedef set<pair<rsa_keypair_id, pair<cert_name, cert_value> > > cdat;
+  typedef set<pair<key_name, pair<cert_name, cert_value> > > cdat;
 
   int n = 1;
   for (cdat::const_iterator i = certs.begin(); i != certs.end(); ++i)
@@ -1012,7 +1012,7 @@ bool
 }
 
 bool
-lua_hooks::hook_note_netsync_pubkey_received(rsa_keypair_id const & kid,
+lua_hooks::hook_note_netsync_pubkey_received(key_name const & kid,
                                              size_t session_id)
 {
   Lua ll(st);
@@ -1026,7 +1026,7 @@ bool
 }
 
 bool
-lua_hooks::hook_note_netsync_pubkey_sent(rsa_keypair_id const & kid,
+lua_hooks::hook_note_netsync_pubkey_sent(key_name const & kid,
                                              size_t session_id)
 {
   Lua ll(st);
@@ -1041,7 +1041,7 @@ lua_hooks::hook_note_netsync_cert_receiv
 
 bool
 lua_hooks::hook_note_netsync_cert_received(revision_id const & rid,
-                                           rsa_keypair_id const & kid,
+                                           key_name const & kid,
                                            cert_name const & name,
                                            cert_value const & value,
                                            size_t session_id)
@@ -1061,7 +1061,7 @@ lua_hooks::hook_note_netsync_cert_sent(r
 
 bool
 lua_hooks::hook_note_netsync_cert_sent(revision_id const & rid,
-                                           rsa_keypair_id const & kid,
+                                           key_name const & kid,
                                            cert_name const & name,
                                            cert_value const & value,
                                            size_t session_id)
============================================================
--- lua_hooks.hh	13b02250e084d7e1d04d9df095f4409d3b6189bb
+++ lua_hooks.hh	07356795d81fbfd324c6261089386e28b77c1b75
@@ -48,31 +48,31 @@ public:
   // cert hooks
   bool hook_expand_selector(std::string const & sel, std::string & exp);
   bool hook_expand_date(std::string const & sel, std::string & exp);
-  bool hook_get_branch_key(branch_name const & branchname, rsa_keypair_id & k);
-  bool hook_get_passphrase(rsa_keypair_id const & k, std::string & phrase);
+  bool hook_get_branch_key(branch_name const & branchname, key_name & k);
+  bool hook_get_passphrase(key_name const & k, std::string & phrase);
   bool hook_get_author(branch_name const & branchname,
-                       rsa_keypair_id const & k,
+                       key_name const & k,
                        std::string & author);
   bool hook_edit_comment(external const & commentary,
                          external const & user_log_message,
                          external & result);
   bool hook_persist_phrase_ok();
-  bool hook_get_revision_cert_trust(std::set<rsa_keypair_id> const & signers,
+  bool hook_get_revision_cert_trust(std::set<key_name> const & signers,
                                    id const & hash,
                                    cert_name const & name,
                                    cert_value const & val);
-  bool hook_get_manifest_cert_trust(std::set<rsa_keypair_id> const & signers,
+  bool hook_get_manifest_cert_trust(std::set<key_name> const & signers,
                                     id const & hash,
                                     cert_name const & name,
                                     cert_value const & val);
-  bool hook_accept_testresult_change(std::map<rsa_keypair_id, bool> const & old_results,
-                                     std::map<rsa_keypair_id, bool> const & new_results);
+  bool hook_accept_testresult_change(std::map<key_name, bool> const & old_results,
+                                     std::map<key_name, bool> const & new_results);
 
   // network hooks
   bool hook_get_netsync_key(utf8 const & server_address,
                             globish const & include,
                             globish const & exclude,
-                            rsa_keypair_id & k);
+                            key_name & k);
   bool hook_get_netsync_connect_command(uri const & u,
                                         globish const & include_pattern,
                                         globish const & exclude_pattern,
@@ -81,10 +81,10 @@ public:
   bool hook_use_transport_auth(uri const & u);
 
   bool hook_get_netsync_read_permitted(std::string const & branch,
-                                       rsa_keypair_id const & identity);
+                                       key_name const & identity);
   // anonymous no-key version
   bool hook_get_netsync_read_permitted(std::string const & branch);
-  bool hook_get_netsync_write_permitted(rsa_keypair_id const & identity);
+  bool hook_get_netsync_write_permitted(key_name const & identity);
 
   // local repo hooks
   bool hook_ignore_file(file_path const & p);
@@ -146,32 +146,32 @@ public:
                                std::string my_role,
                                int sync_type,
                                std::string remote_host,
-                               rsa_keypair_id remote_keyname,
+                               key_name remote_keyname,
                                globish include_pattern,
                                globish exclude_pattern);
   bool hook_note_netsync_revision_received(revision_id const & new_id,
                                            revision_data const & rdat,
-                                           std::set<std::pair<rsa_keypair_id,
+                                           std::set<std::pair<key_name,
                                            std::pair<cert_name,
                                            cert_value> > > const & certs,
                                            size_t session_id);
   bool hook_note_netsync_revision_sent(revision_id const & new_id,
                                        revision_data const & rdat,
-                                       std::set<std::pair<rsa_keypair_id,
+                                       std::set<std::pair<key_name,
                                        std::pair<cert_name,
                                        cert_value> > > const & certs,
                                        size_t session_id);
-  bool hook_note_netsync_pubkey_received(rsa_keypair_id const & kid,
+  bool hook_note_netsync_pubkey_received(key_name const & kid,
                                          size_t session_id);
-  bool hook_note_netsync_pubkey_sent(rsa_keypair_id const & kid,
+  bool hook_note_netsync_pubkey_sent(key_name const & kid,
                                      size_t session_id);
   bool hook_note_netsync_cert_received(revision_id const & rid,
-                                       rsa_keypair_id const & kid,
+                                       key_name const & kid,
                                        cert_name const & name,
                                        cert_value const & value,
                                        size_t session_id);
   bool hook_note_netsync_cert_sent(revision_id const & rid,
-                                   rsa_keypair_id const & kid,
+                                   key_name const & kid,
                                    cert_name const & name,
                                    cert_value const & value,
                                    size_t session_id);
============================================================
--- migrate_schema.cc	a53016bd522dc676d9df6767369e5d28bf526868
+++ migrate_schema.cc	f987fd101b23760fee0b5a5cd21ad955e1d6bc1d
@@ -533,7 +533,7 @@ migrate_to_external_privkeys(sqlite3 * d
 
     while (stmt.step())
       {
-        rsa_keypair_id ident(stmt.column_string(0), origin::database);
+        key_name ident(stmt.column_string(0), origin::database);
         base64<old_arc4_rsa_priv_key> old_priv(stmt.column_string(1),
                                                origin::database);
         base64<rsa_pub_key> pub;
============================================================
--- netcmd.cc	64d6c56e6b3de68bd2e3cf34c3530b5fb14b54d5
+++ netcmd.cc	0c56fd7f8c57093b24b03fad157db98ddd60aed6
@@ -206,7 +206,7 @@ void
 
 
 void
-netcmd::read_hello_cmd(rsa_keypair_id & server_keyname,
+netcmd::read_hello_cmd(key_name & server_keyname,
                        rsa_pub_key & server_key,
                        id & nonce) const
 {
@@ -215,7 +215,7 @@ netcmd::read_hello_cmd(rsa_keypair_id & 
   string skn_str, sk_str;
   extract_variable_length_string(payload, skn_str, pos,
                                  "hello netcmd, server key name");
-  server_keyname = rsa_keypair_id(skn_str, origin::network);
+  server_keyname = key_name(skn_str, origin::network);
   extract_variable_length_string(payload, sk_str, pos,
                                  "hello netcmd, server key");
   server_key = rsa_pub_key(sk_str, origin::network);
@@ -226,7 +226,7 @@ void
 }
 
 void
-netcmd::write_hello_cmd(rsa_keypair_id const & server_keyname,
+netcmd::write_hello_cmd(key_name const & server_keyname,
                         rsa_pub_key const & server_key,
                         id const & nonce)
 {
============================================================
--- netcmd.hh	9fd97280633714008862a4a261403461d335fed5
+++ netcmd.hh	7ae6803e6f436b4fcf76f26c29a6f1b62234545a
@@ -116,10 +116,10 @@ public:
   void read_error_cmd(std::string & errmsg) const;
   void write_error_cmd(std::string const & errmsg);
 
-  void read_hello_cmd(rsa_keypair_id & server_keyname,
+  void read_hello_cmd(key_name & server_keyname,
                       rsa_pub_key & server_key,
                       id & nonce) const;
-  void write_hello_cmd(rsa_keypair_id const & server_keyname,
+  void write_hello_cmd(key_name const & server_keyname,
                        rsa_pub_key const & server_key,
                        id const & nonce);
 
============================================================
--- netsync.cc	9352f59c67d47e16991713015356bc0bc971b863
+++ netsync.cc	a0c2d1d33f00a3470db30b9a70003e36ef0a69a1
@@ -288,19 +288,19 @@ read_pubkey(string const & in,
 
 static void
 read_pubkey(string const & in,
-            rsa_keypair_id & id,
+            key_name & id,
             rsa_pub_key & pub)
 {
   string tmp_id, tmp_key;
   size_t pos = 0;
   extract_variable_length_string(in, tmp_id, pos, "pubkey id");
   extract_variable_length_string(in, tmp_key, pos, "pubkey value");
-  id = rsa_keypair_id(tmp_id, origin::network);
+  id = key_name(tmp_id, origin::network);
   pub = rsa_pub_key(tmp_key, origin::network);
 }
 
 static void
-write_pubkey(rsa_keypair_id const & id,
+write_pubkey(key_name const & id,
              rsa_pub_key const & pub,
              string & out)
 {
@@ -631,8 +631,8 @@ session:
   key_store & keys;
   lua_hooks & lua;
   bool use_transport_auth;
-  rsa_keypair_id const & signing_key;
-  vector<rsa_keypair_id> const & keys_to_push;
+  key_name const & signing_key;
+  vector<key_name> const & keys_to_push;
 
   netcmd cmd;
   bool armed;
@@ -641,7 +641,7 @@ private:
 private:
 
   bool received_remote_key;
-  rsa_keypair_id remote_peer_key_name;
+  key_name remote_peer_key_name;
   netsync_session_key session_key;
   chained_hmac read_hmac;
   chained_hmac write_hmac;
@@ -665,12 +665,12 @@ private:
 
   // These are read from the server, written to the local database
   vector<revision_id> written_revisions;
-  vector<rsa_keypair_id> written_keys;
+  vector<key_name> written_keys;
   vector<cert> written_certs;
 
   // These are sent to the server
   vector<revision_id> sent_revisions;
-  vector<rsa_keypair_id> sent_keys;
+  vector<key_name> sent_keys;
   vector<cert> sent_certs;
 
   id saved_nonce;
@@ -759,7 +759,7 @@ private:
   void queue_bye_cmd(u8 phase);
   void queue_error_cmd(string const & errmsg);
   void queue_done_cmd(netcmd_item_type type, size_t n_items);
-  void queue_hello_cmd(rsa_keypair_id const & key_name,
+  void queue_hello_cmd(key_name const & key_name,
                        rsa_pub_key const & pub_encoded,
                        id const & nonce);
   void queue_anonymous_cmd(protocol_role role,
@@ -785,7 +785,7 @@ private:
 
   // Incoming dispatch-called methods.
   bool process_error_cmd(string const & errmsg);
-  bool process_hello_cmd(rsa_keypair_id const & server_keyname,
+  bool process_hello_cmd(key_name const & server_keyname,
                          rsa_pub_key const & server_key,
                          id const & nonce);
   bool process_bye_cmd(u8 phase, transaction_guard & guard);
@@ -920,7 +920,7 @@ session::~session()
     {
 
       //Keys
-      for (vector<rsa_keypair_id>::iterator i = written_keys.begin();
+      for (vector<key_name>::iterator i = written_keys.begin();
            i != written_keys.end(); ++i)
         {
           lua.hook_note_netsync_pubkey_received(*i, session_id);
@@ -931,7 +931,7 @@ session::~session()
            i != written_revisions.end(); ++i)
         {
           vector<cert> & ctmp(rev_written_certs[*i]);
-          set<pair<rsa_keypair_id, pair<cert_name, cert_value> > > certs;
+          set<pair<key_name, pair<cert_name, cert_value> > > certs;
           for (vector<cert>::const_iterator j = ctmp.begin();
                j != ctmp.end(); ++j)
             certs.insert(make_pair(j->key, make_pair(j->name, j->value)));
@@ -971,7 +971,7 @@ session::~session()
         }
 
       //Keys
-      for (vector<rsa_keypair_id>::iterator i = sent_keys.begin();
+      for (vector<key_name>::iterator i = sent_keys.begin();
            i != sent_keys.end(); ++i)
         {
           lua.hook_note_netsync_pubkey_sent(*i, session_id);
@@ -982,7 +982,7 @@ session::~session()
            i != sent_revisions.end(); ++i)
         {
           vector<cert> & ctmp(rev_sent_certs[*i]);
-          set<pair<rsa_keypair_id, pair<cert_name, cert_value> > > certs;
+          set<pair<key_name, pair<cert_name, cert_value> > > certs;
           for (vector<cert>::const_iterator j = ctmp.begin();
                j != ctmp.end(); ++j)
             certs.insert(make_pair(j->key, make_pair(j->name, j->value)));
@@ -1411,7 +1411,7 @@ void
 }
 
 void
-session::queue_hello_cmd(rsa_keypair_id const & key_name,
+session::queue_hello_cmd(key_name const & key_name,
                          rsa_pub_key const & pub,
                          id const & nonce)
 {
@@ -1578,7 +1578,7 @@ bool
 static const var_domain known_servers_domain = var_domain("known-servers");
 
 bool
-session::process_hello_cmd(rsa_keypair_id const & their_keyname,
+session::process_hello_cmd(key_name const & their_keyname,
                            rsa_pub_key const & their_key,
                            id const & nonce)
 {
@@ -1731,7 +1731,7 @@ session::process_anonymous_cmd(protocol_
   //
 
   lua.hook_note_netsync_start(session_id, "server", their_role,
-                              peer_id, rsa_keypair_id(),
+                              peer_id, key_name(),
                               their_include_pattern, their_exclude_pattern);
 
   // Client must be a sink and server must be a source (anonymous
@@ -1792,7 +1792,7 @@ session::process_anonymous_cmd(protocol_
 
   rebuild_merkle_trees(ok_branches);
 
-  this->remote_peer_key_name = rsa_keypair_id("");
+  this->remote_peer_key_name = key_name("");
   this->authenticated = true;
   return true;
 }
@@ -1836,7 +1836,7 @@ session::process_auth_cmd(protocol_role 
     {
       // If it's not in the db, it still could be in the keystore if we
       // have the private key that goes with it.
-      rsa_keypair_id their_key_id;
+      key_name their_key_id;
       keypair their_keypair;
       if (keys.maybe_get_key_pair(client, their_key_id, their_keypair))
         project.db.put_key(their_key_id, their_keypair.pub);
@@ -1849,7 +1849,7 @@ session::process_auth_cmd(protocol_role 
           this->saved_nonce = id("");
 
           lua.hook_note_netsync_start(session_id, "server", their_role,
-                                      peer_id, rsa_keypair_id("-unknown-"),
+                                      peer_id, key_name("-unknown-"),
                                       their_include_pattern,
                                       their_exclude_pattern);
           error(unknown_key,
@@ -1860,7 +1860,7 @@ session::process_auth_cmd(protocol_role 
     }
 
   // Get their public key.
-  rsa_keypair_id their_id;
+  key_name their_id;
   rsa_pub_key their_key;
   project.db.get_pubkey(client, their_id, their_key);
 
@@ -2177,7 +2177,7 @@ session::load_data(netcmd_item_type type
       break;
     case key_item:
       {
-        rsa_keypair_id keyid;
+        key_name keyid;
         rsa_pub_key pub;
         project.db.get_pubkey(item, keyid, pub);
         L(FL("public key '%s' is also called '%s'") % hitem() % keyid);
@@ -2281,7 +2281,7 @@ session::process_data_cmd(netcmd_item_ty
 
     case key_item:
       {
-        rsa_keypair_id keyid;
+        key_name keyid;
         rsa_pub_key pub;
         read_pubkey(dat, keyid, pub);
         id tmp;
@@ -2433,7 +2433,7 @@ session::dispatch_payload(netcmd const &
       require(! authenticated, "hello netcmd received when not authenticated");
       require(voice == client_voice, "hello netcmd received in client voice");
       {
-        rsa_keypair_id server_keyname;
+        key_name server_keyname;
         rsa_pub_key server_key;
         id nonce;
         cmd.read_hello_cmd(server_keyname, server_key, nonce);
@@ -3366,7 +3366,7 @@ session::rebuild_merkle_trees(set<branch
   ticker keys_ticker(N_("keys"), "k", 1);
 
   set<revision_id> revision_ids;
-  set<rsa_keypair_id> inserted_keys;
+  set<key_name> inserted_keys;
 
   {
     for (set<branch_name>::const_iterator i = branchnames.begin();
@@ -3424,7 +3424,7 @@ session::rebuild_merkle_trees(set<branch
 
   {
     typedef vector< pair<revision_id,
-      pair<revision_id, rsa_keypair_id> > > cert_idx;
+      pair<revision_id, key_name> > > cert_idx;
 
     cert_idx idx;
     project.db.get_revision_cert_nobranch_index(idx);
@@ -3436,7 +3436,7 @@ session::rebuild_merkle_trees(set<branch
       {
         revision_id const & hash = i->first;
         revision_id const & ident = i->second.first;
-        rsa_keypair_id const & key = i->second.second;
+        key_name const & key = i->second.second;
 
         rev_enumerator.note_cert(ident, hash.inner());
 
@@ -3451,7 +3451,7 @@ session::rebuild_merkle_trees(set<branch
   }
 
   // Add any keys specified on the command line.
-  for (vector<rsa_keypair_id>::const_iterator key
+  for (vector<key_name>::const_iterator key
          = keys_to_push.begin();
        key != keys_to_push.end(); ++key)
     {
@@ -3470,7 +3470,7 @@ session::rebuild_merkle_trees(set<branch
     }
 
   // Insert all the keys.
-  for (set<rsa_keypair_id>::const_iterator key = inserted_keys.begin();
+  for (set<key_name>::const_iterator key = inserted_keys.begin();
        key != inserted_keys.end(); key++)
     {
       if (project.db.public_key_exists(*key))
============================================================
--- options_list.hh	fe3b7714d2c58e05d75fefc8d28bbe5935d22051
+++ options_list.hh	04514511db1d6d12e25f355816b21203822c89b2
@@ -379,11 +379,11 @@ GOPT(ignore_suspend_certs, "ignore-suspe
 #endif
 
 
-OPTVAR(key, rsa_keypair_id, signing_key, )
+OPTVAR(key, key_name, signing_key, )
 OPTION(globals, key, true, "key,k", gettext_noop("set key for signatures"))
 #ifdef option_bodies
 {
-  internalize_rsa_keypair_id(utf8(arg, origin::user), signing_key);
+  internalize_key_name(utf8(arg, origin::user), signing_key);
 }
 #endif
 
@@ -398,13 +398,13 @@ OPTION(globals, key_dir, true, "keydir",
 }
 #endif
 
-OPTVAR(key_to_push, std::vector<rsa_keypair_id>, keys_to_push, )
+OPTVAR(key_to_push, std::vector<key_name>, keys_to_push, )
 OPTION(key_to_push, key_to_push, true, "key-to-push",
         gettext_noop("push the specified key even if it hasn't signed anything"))
 #ifdef option_bodies
 {
-  rsa_keypair_id keyid;
-  internalize_rsa_keypair_id(utf8(arg, origin::user), keyid);
+  key_name keyid;
+  internalize_key_name(utf8(arg, origin::user), keyid);
   keys_to_push.push_back(keyid);
 }
 #endif
============================================================
--- packet.cc	d0dc9d47397f902117459c3d82bd34f100e75d76
+++ packet.cc	f092ffd73ce8c46f055fe96f5a25f1566d5bbfc7
@@ -83,7 +83,7 @@ void
 }
 
 void
-packet_writer::consume_public_key(rsa_keypair_id const & ident,
+packet_writer::consume_public_key(key_name const & ident,
                                   rsa_pub_key const & k)
 {
   ost << "[pubkey " << ident() << "]\n"
@@ -92,7 +92,7 @@ void
 }
 
 void
-packet_writer::consume_key_pair(rsa_keypair_id const & ident,
+packet_writer::consume_key_pair(key_name const & ident,
                                 keypair const & kp)
 {
   ost << "[keypair " << ident() << "]\n"
@@ -102,7 +102,7 @@ void
 }
 
 void
-packet_writer::consume_old_private_key(rsa_keypair_id const & ident,
+packet_writer::consume_old_private_key(key_name const & ident,
                                        old_arc4_rsa_priv_key const & k)
 {
   ost << "[privkey " << ident() << "]\n"
@@ -228,7 +228,7 @@ namespace
       cert t = cert(hash,
                     cert_name(name, made_from),
                     decode_base64_as<cert_value>(val, made_from),
-                    rsa_keypair_id(keyid, made_from),
+                    key_name(keyid, made_from),
                     decode_base64_as<rsa_sha1_signature>(body, made_from));
       cons.consume_revision_cert(t);
     }
@@ -239,7 +239,7 @@ namespace
       validate_key(args);
       validate_base64(body);
 
-      cons.consume_public_key(rsa_keypair_id(args, made_from),
+      cons.consume_public_key(key_name(args, made_from),
                               decode_base64_as<rsa_pub_key>(body, made_from));
     }
 
@@ -253,7 +253,7 @@ namespace
       validate_key(args);
       validate_base64(pub);
       validate_base64(priv);
-      cons.consume_key_pair(rsa_keypair_id(args, made_from),
+      cons.consume_key_pair(key_name(args, made_from),
                             keypair(decode_base64_as<rsa_pub_key>(pub, made_from),
                                     decode_base64_as<rsa_priv_key>(priv, made_from)));
     }
@@ -263,7 +263,7 @@ namespace
       L(FL("read privkey packet"));
       validate_key(args);
       validate_base64(body);
-      cons.consume_old_private_key(rsa_keypair_id(args, made_from),
+      cons.consume_old_private_key(key_name(args, made_from),
                                    decode_base64_as<old_arc4_rsa_priv_key>(body, made_from));
     }
 
============================================================
--- packet.hh	c2de8fab34088703def8bdd9d33ef544bc68e585
+++ packet.hh	0a224e6e92f244e2c3e9a5cdb935eb8613d7e85b
@@ -49,11 +49,11 @@ public:
   virtual void consume_revision_cert(cert const & t) = 0;
 
 
-  virtual void consume_public_key(rsa_keypair_id const & ident,
+  virtual void consume_public_key(key_name const & ident,
                                   rsa_pub_key const & k) = 0;
-  virtual void consume_key_pair(rsa_keypair_id const & ident,
+  virtual void consume_key_pair(key_name const & ident,
                                 keypair const & kp) = 0;
-  virtual void consume_old_private_key(rsa_keypair_id const & ident,
+  virtual void consume_old_private_key(key_name const & ident,
                                        old_arc4_rsa_priv_key const & k) = 0;
 };
 
@@ -74,11 +74,11 @@ struct packet_writer : public packet_con
                                      revision_data const & dat);
   virtual void consume_revision_cert(cert const & t);
 
-  virtual void consume_public_key(rsa_keypair_id const & ident,
+  virtual void consume_public_key(key_name const & ident,
                                   rsa_pub_key const & k);
-  virtual void consume_key_pair(rsa_keypair_id const & ident,
+  virtual void consume_key_pair(key_name const & ident,
                                 keypair const & kp);
-  virtual void consume_old_private_key(rsa_keypair_id const & ident,
+  virtual void consume_old_private_key(key_name const & ident,
                                        old_arc4_rsa_priv_key const & k);
 };
 
============================================================
--- project.cc	a56b3892d2c9cdaa9a1de14bd420ecafe273b9a9
+++ project.cc	ddcb2a90ab0ba89562edd96ce1ea83f9da7b7b82
@@ -278,7 +278,7 @@ tag_t::tag_t(revision_id const & ident,
 
 tag_t::tag_t(revision_id const & ident,
              utf8 const & name,
-             rsa_keypair_id const & key)
+             key_name const & key)
   : ident(ident), name(name), key(key)
 {}
 
@@ -366,7 +366,7 @@ project_t::put_standard_certs_from_optio
   string author = opts.author();
   if (author.empty())
     {
-      rsa_keypair_id key;
+      key_name key;
       get_user_key(opts, lua, db, keys, key);
 
       if (!lua.hook_get_author(branch, key, author))
============================================================
--- project.hh	055d2051d5452036c0934c741f23153eac9c3fcc
+++ project.hh	e2f0f5db26a6d8bbe9214b264aca96b58513fcc8
@@ -47,8 +47,8 @@ public:
 public:
   revision_id ident;
   utf8 name;
-  rsa_keypair_id key;
-  tag_t(revision_id const & ident, utf8 const & name, rsa_keypair_id const & key);
+  key_name key;
+  tag_t(revision_id const & ident, utf8 const & name, key_name const & key);
 };
 bool operator < (tag_t const & a, tag_t const & b);
 
============================================================
--- update.cc	dba7f76d0acb65a068cac1dddb85f8d50a60304b
+++ update.cc	a67ae873fc4fca77ae07922e0b6869fc837ae550
@@ -55,7 +55,7 @@ get_test_results_for_revision(project_t 
 static void
 get_test_results_for_revision(project_t & project,
                               revision_id const & id,
-                              map<rsa_keypair_id, bool> & results)
+                              map<key_name, bool> & results)
 {
   vector<cert> certs;
   project.get_revision_certs_by_name(id, cert_name(testresult_cert_name),
@@ -81,7 +81,7 @@ acceptable_descendent(lua_hooks & lua,
                       project_t & project,
                       branch_name const & branch,
                       revision_id const & base,
-                      map<rsa_keypair_id, bool> & base_results,
+                      map<key_name, bool> & base_results,
                       revision_id const & target)
 {
   L(FL("Considering update target %s") % target);
@@ -94,7 +94,7 @@ acceptable_descendent(lua_hooks & lua,
     }
 
   // step 2: check the testresults
-  map<rsa_keypair_id, bool> target_results;
+  map<key_name, bool> target_results;
   get_test_results_for_revision(project, target, target_results);
   if (lua.hook_accept_testresult_change(base_results, target_results))
     {
@@ -119,7 +119,7 @@ pick_update_candidates(lua_hooks & lua,
   I(!null_id(base));
   I(!branch().empty());
 
-  map<rsa_keypair_id, bool> base_results;
+  map<key_name, bool> base_results;
   get_test_results_for_revision(project, base, base_results);
 
   candidates.clear();
============================================================
--- vocab.cc	b6008dbf8b209e237952bb90e934f94d6fbca416
+++ vocab.cc	d132d79afee66989919564bbfceb93f7590d2d37
@@ -82,7 +82,7 @@ inline void
 }
 
 inline void
-verify(rsa_keypair_id const & val)
+verify(key_name const & val)
 {
   string::size_type pos = val().find_first_not_of(constants::legal_key_name_bytes);
   E(pos == string::npos, val.made_from,
============================================================
--- vocab_terms.hh	28341d787d1cbaba84a00ab5b176939b0a81e05e
+++ vocab_terms.hh	bedb85f7daae7ba8565203769aba9e3db3ba25fd
@@ -33,7 +33,7 @@ ATOMIC_NOVERIFY(var_value);   // symbol-
 ATOMIC_NOVERIFY(var_name);    // symbol-of-your-choosing
 ATOMIC_NOVERIFY(var_value);   // symbol-of-your-choosing
 
-ATOMIC(rsa_keypair_id);              // address@hidden
+ATOMIC(key_name);              // address@hidden
 ATOMIC_NOVERIFY(rsa_pub_key);        // some nice numbers
 ATOMIC_NOVERIFY(rsa_priv_key);       // some nice numbers
 ATOMIC_NOVERIFY(old_arc4_rsa_priv_key); // ... in the old storage format
============================================================
--- work.cc	766cbbfd5b78c442ed6fc650846daa55f9d42768
+++ work.cc	d121755f373bba8299dae44edff0f892ffbb4034
@@ -400,7 +400,7 @@ read_options_file(any_path const & optsp
 read_options_file(any_path const & optspath,
                   system_path & workspace_database,
                   branch_name & workspace_branch,
-                  rsa_keypair_id & workspace_key,
+                  key_name & workspace_key,
                   system_path & workspace_keydir)
 {
   data dat;
@@ -429,7 +429,7 @@ read_options_file(any_path const & optsp
       else if (opt == "branch")
         workspace_branch = branch_name(val, origin::workspace);
       else if (opt == "key")
-        internalize_rsa_keypair_id(utf8(val, origin::workspace), workspace_key);
+        internalize_key_name(utf8(val, origin::workspace), workspace_key);
       else if (opt == "keydir")
         workspace_keydir = system_path(val, origin::workspace);
       else
@@ -444,7 +444,7 @@ write_options_file(bookkeeping_path cons
 write_options_file(bookkeeping_path const & optspath,
                    system_path const & workspace_database,
                    branch_name const & workspace_branch,
-                   rsa_keypair_id const & workspace_key,
+                   key_name const & workspace_key,
                    system_path const & workspace_keydir)
 {
   basic_io::stanza st;
@@ -455,7 +455,7 @@ write_options_file(bookkeeping_path cons
   if (!workspace_key().empty())
     {
       utf8 key;
-      externalize_rsa_keypair_id(workspace_key, key);
+      externalize_key_name(workspace_key, key);
       st.push_str_pair(symbol("key"), key());
     }
   if (!workspace_keydir.as_internal().empty())
@@ -481,7 +481,7 @@ workspace::get_options(options & opts)
 
   system_path workspace_database;
   branch_name workspace_branch;
-  rsa_keypair_id workspace_key;
+  key_name workspace_key;
   system_path workspace_keydir;
 
   bookkeeping_path o_path;
@@ -519,7 +519,7 @@ workspace::get_database_option(system_pa
                                system_path & workspace_database)
 {
   branch_name workspace_branch;
-  rsa_keypair_id workspace_key;
+  key_name workspace_key;
   system_path workspace_keydir;
 
   system_path o_path = (workspace
@@ -542,7 +542,7 @@ workspace::set_options(options const & o
   // as is in _MTN/options, not write out an empty option.
   system_path workspace_database;
   branch_name workspace_branch;
-  rsa_keypair_id workspace_key;
+  key_name workspace_key;
   system_path workspace_keydir;
 
   if (file_exists(o_path))
@@ -581,7 +581,7 @@ workspace::print_option(utf8 const & opt
 
   system_path workspace_database;
   branch_name workspace_branch;
-  rsa_keypair_id workspace_key;
+  key_name workspace_key;
   system_path workspace_keydir;
   read_options_file(o_path,
                     workspace_database, workspace_branch,