diff --git a/peer.go b/peer.go
index 355f4731..bf819087 100644
--- a/peer.go
+++ b/peer.go
@@ -7,9 +7,9 @@ import (
 	"time"
 
 	"github.com/pkg/errors"
-	cmn "github.com/tendermint/tmlibs/common"
 	crypto "github.com/tendermint/go-crypto"
 	wire "github.com/tendermint/go-wire"
+	cmn "github.com/tendermint/tmlibs/common"
 )
 
 // Peer could be marked as persistent, in which case you can use
@@ -166,7 +166,7 @@ func (p *Peer) HandshakeTimeout(ourNodeInfo *NodeInfo, timeout time.Duration) er
 
 	if p.config.AuthEnc {
 		// Check that the professed PubKey matches the sconn's.
-		if !peerNodeInfo.PubKey.Equals(p.PubKey()) {
+		if !peerNodeInfo.PubKey.Equals(p.PubKey().Wrap()) {
 			return fmt.Errorf("Ignoring connection with unmatching pubkey: %v vs %v",
 				peerNodeInfo.PubKey, p.PubKey())
 		}
diff --git a/peer_test.go b/peer_test.go
index 5f3ed0e2..0ac77634 100644
--- a/peer_test.go
+++ b/peer_test.go
@@ -87,7 +87,7 @@ func createOutboundPeerAndPerformHandshake(addr *NetAddress, config *PeerConfig)
 		return nil, err
 	}
 	err = p.HandshakeTimeout(&NodeInfo{
-		PubKey:  pk.PubKey().(crypto.PubKeyEd25519),
+		PubKey:  pk.PubKey().Unwrap().(crypto.PubKeyEd25519),
 		Moniker: "host_peer",
 		Network: "testing",
 		Version: "123.123.123",
@@ -110,7 +110,7 @@ func (p *remotePeer) Addr() *NetAddress {
 }
 
 func (p *remotePeer) PubKey() crypto.PubKeyEd25519 {
-	return p.PrivKey.PubKey().(crypto.PubKeyEd25519)
+	return p.PrivKey.PubKey().Unwrap().(crypto.PubKeyEd25519)
 }
 
 func (p *remotePeer) Start() {
@@ -138,7 +138,7 @@ func (p *remotePeer) accept(l net.Listener) {
 			golog.Fatalf("Failed to create a peer: %+v", err)
 		}
 		err = peer.HandshakeTimeout(&NodeInfo{
-			PubKey:  p.PrivKey.PubKey().(crypto.PubKeyEd25519),
+			PubKey:  p.PrivKey.PubKey().Unwrap().(crypto.PubKeyEd25519),
 			Moniker: "remote_peer",
 			Network: "testing",
 			Version: "123.123.123",
diff --git a/secret_connection.go b/secret_connection.go
index 49535a40..446c4f18 100644
--- a/secret_connection.go
+++ b/secret_connection.go
@@ -20,9 +20,9 @@ import (
 	"golang.org/x/crypto/nacl/secretbox"
 	"golang.org/x/crypto/ripemd160"
 
-	. "github.com/tendermint/tmlibs/common"
 	"github.com/tendermint/go-crypto"
 	"github.com/tendermint/go-wire"
+	. "github.com/tendermint/tmlibs/common"
 )
 
 // 2 + 1024 == 1026 total frame size
@@ -48,7 +48,7 @@ type SecretConnection struct {
 // See docs/sts-final.pdf for more information.
 func MakeSecretConnection(conn io.ReadWriteCloser, locPrivKey crypto.PrivKeyEd25519) (*SecretConnection, error) {
 
-	locPubKey := locPrivKey.PubKey().(crypto.PubKeyEd25519)
+	locPubKey := locPrivKey.PubKey().Unwrap().(crypto.PubKeyEd25519)
 
 	// Generate ephemeral keys for perfect forward secrecy.
 	locEphPub, locEphPriv := genEphKeys()
@@ -96,7 +96,7 @@ func MakeSecretConnection(conn io.ReadWriteCloser, locPrivKey crypto.PrivKeyEd25
 	}
 
 	// We've authorized.
-	sc.remPubKey = remPubKey.(crypto.PubKeyEd25519)
+	sc.remPubKey = remPubKey.Unwrap().(crypto.PubKeyEd25519)
 	return sc, nil
 }
 
@@ -255,7 +255,7 @@ func genChallenge(loPubKey, hiPubKey *[32]byte) (challenge *[32]byte) {
 }
 
 func signChallenge(challenge *[32]byte, locPrivKey crypto.PrivKeyEd25519) (signature crypto.SignatureEd25519) {
-	signature = locPrivKey.Sign(challenge[:]).(crypto.SignatureEd25519)
+	signature = locPrivKey.Sign(challenge[:]).Unwrap().(crypto.SignatureEd25519)
 	return
 }
 
@@ -270,7 +270,7 @@ func shareAuthSignature(sc *SecretConnection, pubKey crypto.PubKeyEd25519, signa
 
 	Parallel(
 		func() {
-			msgBytes := wire.BinaryBytes(authSigMessage{pubKey, signature})
+			msgBytes := wire.BinaryBytes(authSigMessage{pubKey.Wrap(), signature.Wrap()})
 			_, err1 = sc.Write(msgBytes)
 		},
 		func() {
@@ -294,7 +294,7 @@ func shareAuthSignature(sc *SecretConnection, pubKey crypto.PubKeyEd25519, signa
 }
 
 func verifyChallengeSignature(challenge *[32]byte, remPubKey crypto.PubKeyEd25519, remSignature crypto.SignatureEd25519) bool {
-	return remPubKey.VerifyBytes(challenge[:], remSignature)
+	return remPubKey.VerifyBytes(challenge[:], remSignature.Wrap())
 }
 
 //--------------------------------------------------------------------------------
diff --git a/secret_connection_test.go b/secret_connection_test.go
index 58459e62..3dd962f8 100644
--- a/secret_connection_test.go
+++ b/secret_connection_test.go
@@ -5,8 +5,8 @@ import (
 	"io"
 	"testing"
 
-	. "github.com/tendermint/tmlibs/common"
 	"github.com/tendermint/go-crypto"
+	. "github.com/tendermint/tmlibs/common"
 )
 
 type dummyConn struct {
@@ -33,9 +33,9 @@ func makeDummyConnPair() (fooConn, barConn dummyConn) {
 func makeSecretConnPair(tb testing.TB) (fooSecConn, barSecConn *SecretConnection) {
 	fooConn, barConn := makeDummyConnPair()
 	fooPrvKey := crypto.GenPrivKeyEd25519()
-	fooPubKey := fooPrvKey.PubKey().(crypto.PubKeyEd25519)
+	fooPubKey := fooPrvKey.PubKey().Unwrap().(crypto.PubKeyEd25519)
 	barPrvKey := crypto.GenPrivKeyEd25519()
-	barPubKey := barPrvKey.PubKey().(crypto.PubKeyEd25519)
+	barPubKey := barPrvKey.PubKey().Unwrap().(crypto.PubKeyEd25519)
 
 	Parallel(
 		func() {
diff --git a/switch.go b/switch.go
index 3e3ab4f8..8c771df1 100644
--- a/switch.go
+++ b/switch.go
@@ -7,10 +7,10 @@ import (
 	"net"
 	"time"
 
-	. "github.com/tendermint/tmlibs/common"
 	cfg "github.com/tendermint/go-config"
 	crypto "github.com/tendermint/go-crypto"
 	"github.com/tendermint/log15"
+	. "github.com/tendermint/tmlibs/common"
 )
 
 const (
@@ -154,7 +154,7 @@ func (sw *Switch) NodeInfo() *NodeInfo {
 func (sw *Switch) SetNodePrivKey(nodePrivKey crypto.PrivKeyEd25519) {
 	sw.nodePrivKey = nodePrivKey
 	if sw.nodeInfo != nil {
-		sw.nodeInfo.PubKey = nodePrivKey.PubKey().(crypto.PubKeyEd25519)
+		sw.nodeInfo.PubKey = nodePrivKey.PubKey().Unwrap().(crypto.PubKeyEd25519)
 	}
 }
 
@@ -213,7 +213,7 @@ func (sw *Switch) AddPeer(peer *Peer) error {
 	}
 
 	// Avoid self
-	if sw.nodeInfo.PubKey.Equals(peer.PubKey()) {
+	if sw.nodeInfo.PubKey.Equals(peer.PubKey().Wrap()) {
 		return errors.New("Ignoring connection from self")
 	}
 
@@ -531,7 +531,7 @@ func makeSwitch(i int, network, version string, initSwitch func(int, *Switch) *S
 	// TODO: let the config be passed in?
 	s := initSwitch(i, NewSwitch(cfg.NewMapConfig(nil)))
 	s.SetNodeInfo(&NodeInfo{
-		PubKey:     privKey.PubKey().(crypto.PubKeyEd25519),
+		PubKey:     privKey.PubKey().Unwrap().(crypto.PubKeyEd25519),
 		Moniker:    Fmt("switch%d", i),
 		Network:    network,
 		Version:    version,