diff --git a/llarp/link/connection.cpp b/llarp/link/connection.cpp
index eb16b9174..9b8760746 100644
--- a/llarp/link/connection.cpp
+++ b/llarp/link/connection.cpp
@@ -4,9 +4,8 @@ namespace llarp::link
 {
   Connection::Connection(
       const std::shared_ptr<oxen::quic::connection_interface>& c,
-      std::shared_ptr<oxen::quic::BTRequestStream>& s,
-      const RemoteRC& rc)
-      : conn{c}, control_stream{s}, remote_rc{std::move(rc)}
+      std::shared_ptr<oxen::quic::BTRequestStream>& s)
+      : conn{c}, control_stream{s}/* , remote_rc{std::move(rc)} */
   {}
 
 }  // namespace llarp::link
diff --git a/llarp/link/connection.hpp b/llarp/link/connection.hpp
index b71a6e9f9..1c5000657 100644
--- a/llarp/link/connection.hpp
+++ b/llarp/link/connection.hpp
@@ -11,7 +11,7 @@ namespace llarp::link
   {
     std::shared_ptr<oxen::quic::connection_interface> conn;
     std::shared_ptr<oxen::quic::BTRequestStream> control_stream;
-    RemoteRC remote_rc;
+    // std::optional<RemoteRC> remote_rc;
 
     // one side of a connection will be responsible for some things, e.g. heartbeat
     bool inbound{false};
@@ -19,8 +19,7 @@ namespace llarp::link
 
     Connection(
         const std::shared_ptr<oxen::quic::connection_interface>& c,
-        std::shared_ptr<oxen::quic::BTRequestStream>& s,
-        const RemoteRC& rc);
+        std::shared_ptr<oxen::quic::BTRequestStream>& s);
   };
 }  // namespace llarp::link
 
diff --git a/llarp/link/link_manager.cpp b/llarp/link/link_manager.cpp
index 49583a2c7..9787d774f 100644
--- a/llarp/link/link_manager.cpp
+++ b/llarp/link/link_manager.cpp
@@ -72,8 +72,16 @@ namespace llarp
       {
         auto itr = conns.begin();
         std::advance(itr, randint() % size);
-        router = itr->second->remote_rc;
-        return true;
+
+        RouterID rid{itr->second->conn->remote_key()};
+        
+        if (auto maybe = link_manager.node_db->get_rc(rid))
+        {
+          router = *maybe;
+          return true;
+        }
+
+        return false;
       }
 
       log::warning(quic_cat, "Error: failed to fetch random connection");
@@ -143,7 +151,7 @@ namespace llarp
     for (auto& method : direct_requests)
     {
       s->register_command(
-          std::string{method.first}, [this, func = method.second](oxen::quic::message m) {
+          std::string{method.first}, [this, func = std::move(method.second)](oxen::quic::message m) {
             _router.loop()->call([this, msg = std::move(m), func = std::move(func)]() mutable {
               auto body = msg.body_str();
               auto respond = [m = std::move(msg)](std::string response) mutable {
@@ -178,24 +186,23 @@ namespace llarp
       bool result = false;
       RouterID other{key.data()};
 
-      // if (auto itr = rids_pending_verification.find(other); itr !=
-      // rids_pending_verification.end())
-      // {
-      //   verified_rids[other] = itr->second;
-      //   rids_pending_verification.erase(itr);
-      //   result = true;
-      // }
-
-      if (_router.node_db()->has_rc(other))
-        result = true;
-
-      // TODO: discuss pubkey verification for bootstraps connecting to seed node
       if (_router.is_bootstrap_seed())
       {
-        log::warning(logcat, "Allowing connection -- we are bootstrap seed");
-        result = true;
+        if (node_db->whitelist().count(other))
+        {
+          auto [it, b] = node_db->seeds().emplace(other);
+          result &= b;
+        }
+        log::critical(
+            logcat,
+            "Bootstrap seed node was {} to confirm fetch requester is white-listed; saving RID",
+            result ? "able" : "unable");
+        return result;
       }
 
+      if (node_db->has_rc(other))
+        result = true;
+
       log::critical(
           logcat, "{}uccessfully verified connection to {}!", result ? "S" : "Uns", other);
       return result;
@@ -383,8 +390,6 @@ namespace llarp
   {
     const auto& scid = ci.scid();
     RouterID rid{ci.remote_key()};
-
-    const auto& rc = verified_rids[rid];
     ep.connid_map.emplace(scid, rid);
     auto [itr, b] = ep.conns.emplace(rid, nullptr);
 
@@ -395,11 +400,9 @@ namespace llarp
       s.conn.close_connection(error_code);
     });
     log::critical(logcat, "Opened BTStream ID:{}", control_stream->stream_id());
-    register_commands(control_stream);
 
-    itr->second = std::make_shared<link::Connection>(ci.shared_from_this(), control_stream, rc);
-    log::critical(logcat, "Successfully configured inbound connection fom {}; storing RC...", rid);
-    node_db->put_rc(rc);
+    itr->second = std::make_shared<link::Connection>(ci.shared_from_this(), control_stream);
+    log::critical(logcat, "Successfully configured inbound connection fom {}...", rid);
   }
 
   // TODO: should we add routes here now that Router::SessionOpen is gone?
@@ -628,13 +631,11 @@ namespace llarp
       const RemoteRC& source, std::string payload, std::function<void(oxen::quic::message m)> func)
   {
     _router.loop()->call([this, source, payload, f = std::move(func)]() mutable {
-      
       if (f)
       {
         f = [this, func = std::move(f)](oxen::quic::message m) mutable {
-          _router.loop()->call([f = std::move(func), msg = std::move(m)]() mutable {
-            f(std::move(msg));
-          });
+          _router.loop()->call(
+              [f = std::move(func), msg = std::move(m)]() mutable { f(std::move(msg)); });
         };
       }
 
@@ -682,14 +683,23 @@ namespace llarp
     }
 
     auto is_seed = _router.is_bootstrap_seed();
+    auto& rid = remote.router_id();
+
+    // TODO: if we are not the seed, how do we check the requester
+    if (is_seed)
+    {
+      // we already insert the 
+      auto& seeds = node_db->seeds();
+      
+      if (auto itr = seeds.find(rid); itr != seeds.end())
+      {
+        log::critical(logcat, "Bootstrap seed confirmed RID:{} is white-listed seeds; approving fetch request and saving RC!", rid);
+        node_db->put_rc(remote);
+      }
+    }
 
     auto& src = is_seed ? node_db->bootstrap_seeds() : node_db->get_known_rcs();
     auto count = src.size();
-    
-    if (is_seed)
-      node_db->bootstrap_seeds().insert(remote);
-    else
-      node_db->put_rc(remote);
 
     if (count == 0)
     {
@@ -716,7 +726,6 @@ namespace llarp
       }
     }
 
-
     m.respond(std::move(btdp).str());
   }
 
diff --git a/llarp/link/link_manager.hpp b/llarp/link/link_manager.hpp
index 4cef45722..69a3107da 100644
--- a/llarp/link/link_manager.hpp
+++ b/llarp/link/link_manager.hpp
@@ -425,7 +425,7 @@ namespace llarp
             });
 
         link_manager.register_commands(control_stream);
-        itr->second = std::make_shared<link::Connection>(conn_interface, control_stream, rc);
+        itr->second = std::make_shared<link::Connection>(conn_interface, control_stream);
 
         return true;
       }
diff --git a/llarp/nodedb.cpp b/llarp/nodedb.cpp
index 75cb8247c..36d58693f 100644
--- a/llarp/nodedb.cpp
+++ b/llarp/nodedb.cpp
@@ -779,12 +779,16 @@ namespace llarp
     router_greenlist.clear();
     router_greenlist.insert(greenlist.begin(), greenlist.end());
 
-    log::info(logcat, "lokinet service node list now has {} active router RIDs", known_rids.size());
+    log::info(
+        logcat,
+        "lokinet service node whitelist now has {} active router RIDs",
+        router_whitelist.size());
   }
 
   std::optional<RouterID>
   NodeDB::get_random_whitelist_router() const
   {
+    // TODO: this should be checking whitelist not known_rcs
     if (auto rc = get_random_rc())
       return rc->router_id();
 
diff --git a/llarp/nodedb.hpp b/llarp/nodedb.hpp
index 6644c4b05..08baa110f 100644
--- a/llarp/nodedb.hpp
+++ b/llarp/nodedb.hpp
@@ -134,6 +134,7 @@ namespace llarp
     std::map<RouterID, const RemoteRC&> rc_lookup;
 
     std::set<RemoteRC> _bootstrap_seeds;
+    std::set<RouterID> _seeds;
     BootstrapList _bootstraps{};
 
     /** RouterID lists    // TODO: get rid of all these, replace with better decom/not staked sets
@@ -191,6 +192,12 @@ namespace llarp
     /// in memory nodedb
     NodeDB();
 
+    std::set<RouterID>&
+    seeds()
+    {
+      return _seeds;
+    }
+
     const std::set<RouterID>&
     get_known_rids() const
     {
diff --git a/llarp/path/pathbuilder.cpp b/llarp/path/pathbuilder.cpp
index 1151f64aa..7c1e94f1b 100644
--- a/llarp/path/pathbuilder.cpp
+++ b/llarp/path/pathbuilder.cpp
@@ -220,8 +220,7 @@ namespace llarp
     {
       std::optional<RemoteRC> found = std::nullopt;
       router->for_each_connection([&](link::Connection& conn) {
-        const auto& rc = conn.remote_rc;
-        const auto& rid = rc.router_id();
+        RouterID rid{conn.conn->remote_key()};
 
 #ifndef TESTNET
         if (router->is_bootstrap_node(rid))
@@ -236,7 +235,7 @@ namespace llarp
         if (router->router_profiling().IsBadForPath(rid))
           return;
 
-        found = rc;
+        found = router->node_db()->get_rc(rid);
       });
       return found;
     }
diff --git a/llarp/router/route_poker.cpp b/llarp/router/route_poker.cpp
index b2a9a1ed5..d578ff7d4 100644
--- a/llarp/router/route_poker.cpp
+++ b/llarp/router/route_poker.cpp
@@ -219,7 +219,7 @@ namespace llarp
 
         // explicit route pokes for first hops
         router.for_each_connection(
-            [this](link::Connection conn) { add_route(conn.remote_rc.addr()); });
+            [this](link::Connection conn) { add_route(conn.conn->remote()); });
 
         add_route(router.link_manager().local());
         // add default route
@@ -238,7 +238,7 @@ namespace llarp
   {
     // unpoke routes for first hops
     router.for_each_connection(
-        [this](link::Connection conn) { delete_route(conn.remote_rc.addr()); });
+        [this](link::Connection conn) { delete_route(conn.conn->remote()); });
     if (is_enabled() and is_up)
     {
       vpn::AbstractRouteManager& route = router.vpn_platform()->RouteManager();
diff --git a/llarp/router/router.cpp b/llarp/router/router.cpp
index 30604f423..f35bdbfbf 100644
--- a/llarp/router/router.cpp
+++ b/llarp/router/router.cpp
@@ -219,7 +219,7 @@ namespace llarp
     std::unordered_set<RouterID> peer_pubkeys;
 
     for_each_connection([&peer_pubkeys](link::Connection& conn) {
-      peer_pubkeys.emplace(conn.remote_rc.router_id());
+      peer_pubkeys.emplace(conn.conn->remote_key());
     });
 
     loop()->call([this, &peer_pubkeys]() {
@@ -652,7 +652,6 @@ namespace llarp
       }
     };
 
-
     for (const auto& router : configRouters)
     {
       log::debug(logcat, "Loading bootstrap router list from {}", defaultBootstrapFile);
@@ -695,8 +694,7 @@ namespace llarp
         throw std::runtime_error("No bootstrap nodes available.");
       }
 
-      log::critical(
-          logcat, "Loaded {} default fallback bootstrap routers!", node_bstrap.size());
+      log::critical(logcat, "Loaded {} default fallback bootstrap routers!", node_bstrap.size());
     }
 
     clear_bad_rcs();