I guess we need to look at how to mix keys and namespaces again.Possibly the trickiest problem with keys is how to upcall key construction to/sbin/request-key when the keys may be of a different user namespace.David