  		err := domain.Save()
  		fatalIf(err)
  	}
-+	if *newUserKey {
-+		if(*commonName=="") {
-+			log.Fatal("commonName is required.")
-+		} else {
-+			domain, err = tao.LoadDomain(*configPath, []byte(*pass))
-+			if(err!=nil) {
-+				fatalIf(err)
-+			}
-+			policyKey:= domain.Keys
-+			fmt.Fprintf(noise, "Creating key for user: %s\n", *commonName)
-+			userKey, err:=  tao.NewTemporaryKeys(tao.Signing)
-+			if userKey==nil || err!= nil {
-+				log.Fatal("Can't create key.")
-+			}
-+			details:= tao.X509Details {
-+			Country: "US",
-+			Organization: "Google",
+ 	if *newUserKey {
+-		if(*commonName=="") {
+-			log.Fatal("commonName is required.")
+-		} else {
+-			domain, err = tao.LoadDomain(*configPath, []byte(*pass))
+-			if(err!=nil) {
+-				fatalIf(err)
+-			}
+-			policyKey:= domain.Keys
+-			fmt.Fprintf(noise, "Creating key for user: %s\n", *commonName)
+-			userKey, err:=  tao.NewTemporaryKeys(tao.Signing)
+-			if userKey==nil || err!= nil {
+-				log.Fatal("Can't create key.")
+-			}
+-			details:= tao.X509Details {
+-			Country: "US",
+-			Organization: "Google",
+-			OrganizationalUnit: *ouName,
+-			CommonName: *commonName, }
+-			subjectname:= tao.NewX509Name(details)
+-			*serialNumber= *serialNumber+1
+-			template := &x509.Certificate {
+-				SignatureAlgorithm: x509.ECDSAWithSHA256,
+-				PublicKeyAlgorithm: x509.ECDSA,
+-				// It's always allowed for self-signed certs to have serial 1.
+-				SerialNumber: new(big.Int).SetInt64(int64(*serialNumber)),
+-				Subject:      *subjectname,
+-				NotBefore:    time.Now(),
+-				NotAfter:     time.Now().AddDate(1 /* years */, 0 /* months */, 0 /* days */),
+-				KeyUsage:    x509.KeyUsageKeyAgreement,
+-				ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+-			}
+-			userDerCert, err := x509.CreateCertificate(rand.Reader, template, policyKey.Cert,
+-				userKey.VerifyingKey.GetVerifierEc(), policyKey.SigningKey.GetSignerEc())
+-			if(err!=nil) {
+-				log.Fatal("Cant create cert\n")
+-			}
+-			err= ioutil.WriteFile(*keyPath+*certFileName, userDerCert, os.ModePerm)
+-			cks, err := tao.MarshalKeyset(userKey)
+-			if err != nil {
+-				log.Fatal("Cant marshal user key.")
+-			}
+-			// TODO?: defer zeroKeyset(cks)
+-			pks, err := proto.Marshal(cks)
+-			if err != nil {
+-				log.Fatal("Cant marshal CryptoKey.")
+-			}
+-			ioutil.WriteFile(*keyPath+*keyFileName, pks, os.ModePerm)
+-		}
+-	}
+-	if *readKey {
+-		pks, err:= ioutil.ReadFile(*keyPath+*keyFileName)
+-		if err != nil {
+-			log.Fatal("Cant read key file.")
++		if *commonName == "" {
++			log.Fatalln("commonName is required")
+ 		}
+-		var cks *tao.CryptoKeyset
+-		err= proto.Unmarshal(pks, cks)
+-		if err != nil {
+-			log.Fatal("Cant key protobuf.")
+-		}
+-		userKey, err:= tao.UnmarshalKeyset(cks)
+-		if err != nil {
+-			log.Fatal("Cant Unmarshal keyset.")
++
++		if domain, err = tao.LoadDomain(*configPath, []byte(*pass)); err != nil {
++			fatalIf(err)
+ 		}
+-		fmt.Printf("user key: ", userKey)
+-		fmt.Printf("\n");
++		policyKey := domain.Keys
++		fmt.Fprintf(noise, "Creating key for user: %s\n", *commonName)
++
++		subjectName := tao.NewX509Name(tao.X509Details{
++			Country:            *country,
++			Organization:       *org,
 +			OrganizationalUnit: *ouName,
-+			CommonName: *commonName, }
-+			subjectname:= tao.NewX509Name(details)
-+			*serialNumber= *serialNumber+1
-+			template := &x509.Certificate {
-+				SignatureAlgorithm: x509.ECDSAWithSHA256,
-+				PublicKeyAlgorithm: x509.ECDSA,
-+				// It's always allowed for self-signed certs to have serial 1.
-+				SerialNumber: new(big.Int).SetInt64(int64(*serialNumber)),
-+				Subject:      *subjectname,
-+				NotBefore:    time.Now(),
-+				NotAfter:     time.Now().AddDate(1 /* years */, 0 /* months */, 0 /* days */),
-+				KeyUsage:    x509.KeyUsageKeyAgreement,
-+				ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
-+			}
-+			userDerCert, err := x509.CreateCertificate(rand.Reader, template, policyKey.Cert,
-+				userKey.VerifyingKey.GetVerifierEc(), policyKey.SigningKey.GetSignerEc())
-+			if(err!=nil) {
-+				log.Fatal("Cant create cert\n")
-+			}
-+			err= ioutil.WriteFile(*keyPath+*certFileName, userDerCert, os.ModePerm)
-+			cks, err := tao.MarshalKeyset(userKey)
-+			if err != nil {
-+				log.Fatal("Cant marshal user key.")
-#*
-#* author: Tom Roeder
-#* email: tmroeder@google.com
-#* date: 2014-11-13T10:41:39-0800
-#*
-#- Spelling. "Cant" (and elsewhere)
-#-
-#*
-#* author: John Manferdelli
-#* email: johnmanferdelli@hotmail.com
-#* date: 2014-11-14T14:18:48-0800
-#*
-#- yep
-#-
-+			}
-+			// TODO?: defer zeroKeyset(cks)
-+			pks, err := proto.Marshal(cks)
-+			if err != nil {
-+				log.Fatal("Cant marshal CryptoKey.")
-+			}
-+			ioutil.WriteFile(*keyPath+*keyFileName, pks, os.ModePerm)
-+		}
-+	}
-+	if *readKey {
-+		pks, err:= ioutil.ReadFile(*keyPath+*keyFileName)
-+		if err != nil {
-+			log.Fatal("Cant read key file.")
-+		}
-+		var cks *tao.CryptoKeyset
-+		err= proto.Unmarshal(pks, cks)
-+		if err != nil {
-+			log.Fatal("Cant key protobuf.")
-+		}
-+		userKey, err:= tao.UnmarshalKeyset(cks)
-+		if err != nil {
-+			log.Fatal("Cant Unmarshal keyset.")
-+		}
-+		fmt.Printf("user key: ", userKey)
-+		fmt.Printf("\n");
-+	}
++			CommonName:         *commonName,
++		})
++		_, err := tao.NewSignedOnDiskPBEKeys(tao.Signing, []byte(*userKeyPass), *keyPath, subjectName, *serialNumber, policyKey)
++		fatalIf(err)
+ 	}
  	if *canExecute != "" {
  		path := *canExecute
  		prin := makeHostPrin(*host)

 
 	policy := *lhsb.Policy
 	switch policy {
-	case SharedSecretPolicyDefault:
-	case SharedSecretPolicyConservative:
+	case SharedSecretPolicyConservative, SharedSecretPolicyDefault:
 		if lhsb.PolicyInfo == nil || child.ChildSubprin.String() != *lhsb.PolicyInfo {
 			return nil, "", newError("principal not authorized for unseal")
 		}

 	help += "%[1]s [options] -(add|retract|query) rule\n"
 	help += "%[1]s [options] -clear\n"
 	flag.Usage = func() {
@@ -118,105 +114,58 @@ func main() {
 		case "ACLs":
 			cfg.ACLGuard.SignedACLsPath = rulesPath
 		case "Datalog":
