* prepare for keytool script * dont serialize ephemeral members in service key file * regnerate ephemeral members in service identity on load * add keygen script * use nacl for generating keys * format