diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index c52d4b62a..1eb2dec75 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -1092,15 +1092,6 @@ void LocalStore::invalidatePath(State & state, const StorePath & path)
 }
 
 
-const PublicKeys & LocalStore::getPublicKeys()
-{
-    auto state(_state.lock());
-    if (!state->publicKeys)
-        state->publicKeys = std::make_unique<PublicKeys>(getDefaultPublicKeys());
-    return *state->publicKeys;
-}
-
-
 void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
     RepairFlag repair, CheckSigsFlag checkSigs)
 {
diff --git a/src/libstore/local-store.hh b/src/libstore/local-store.hh
index ae9497b2e..d97645058 100644
--- a/src/libstore/local-store.hh
+++ b/src/libstore/local-store.hh
@@ -35,10 +35,6 @@ struct LocalStoreConfig : virtual LocalFSStoreConfig
 {
     using LocalFSStoreConfig::LocalFSStoreConfig;
 
-    Setting<bool> requireSigs{(StoreConfig*) this,
-        settings.requireSigs,
-        "require-sigs", "whether store paths should have a trusted signature on import"};
-
     const std::string name() override { return "Local Store"; }
 };
 
@@ -75,8 +71,6 @@ private:
            minFree but not much below availAfterGC, then there is no
            point in starting a new GC. */
         uint64_t availAfterGC = std::numeric_limits<uint64_t>::max();
-
-        std::unique_ptr<PublicKeys> publicKeys;
     };
 
     Sync<State> _state;
@@ -94,12 +88,6 @@ public:
     const Path tempRootsDir;
     const Path fnTempRoots;
 
-private:
-
-    const PublicKeys & getPublicKeys();
-
-public:
-
     // Hack for build-remote.cc.
     PathSet locksHeld;
 
diff --git a/src/libstore/misc.cc b/src/libstore/misc.cc
index ad4dccef9..0d4190a56 100644
--- a/src/libstore/misc.cc
+++ b/src/libstore/misc.cc
@@ -282,4 +282,13 @@ StorePaths Store::topoSortPaths(const StorePathSet & paths)
 }
 
 
+const PublicKeys & Store::getPublicKeys()
+{
+    auto cryptoState(_cryptoState.lock());
+    if (!cryptoState->publicKeys)
+        cryptoState->publicKeys = std::make_unique<PublicKeys>(getDefaultPublicKeys());
+    return *cryptoState->publicKeys;
+}
+
+
 }
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 9bcff08eb..e3de6db17 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -189,6 +189,10 @@ struct StoreConfig : public Config
 
     const Setting<bool> isTrusted{this, false, "trusted", "whether paths from this store can be used as substitutes even when they lack trusted signatures"};
 
+    Setting<bool> requireSigs{this,
+        settings.requireSigs,
+        "require-sigs", "whether store paths should have a trusted signature on import"};
+
     Setting<int> priority{this, 0, "priority", "priority of this substituter (lower value means higher priority)"};
 
     Setting<bool> wantMassQuery{this, false, "want-mass-query", "whether this substituter can be queried efficiently for path validity"};
@@ -710,11 +714,20 @@ public:
         return toRealPath(printStorePath(storePath));
     }
 
+    const PublicKeys & getPublicKeys();
+
     virtual void createUser(const std::string & userName, uid_t userId)
     { }
 
 protected:
 
+    struct CryptoState
+    {
+        std::unique_ptr<PublicKeys> publicKeys;
+    };
+
+    Sync<CryptoState> _cryptoState;
+
     Stats stats;
 
     /* Unsupported methods. */