I guess we need to look at how to mix keys and namespaces again. Possibly the trickiest problem with keys is how to upcall key construction to /sbin/request-key when the keys may be of a different user namespace. David