this has no apparent use as it stands, but opens the door to having the keys managed by an external secrets service