         return nil
     }
     func nacl_verify(signature: String, key: NSData) -> Bool {
+        // key is pubkey
         if let sodium = Sodium() {
             let sig_raw = signature.base64SafeUrlDecode()
             return sodium.sign.verify(self, publicKey: key, signature: sig_raw)

    // based on http://stackoverflow.com/questions/21724337/signing-and-verifying-on-ios-using-rsa

    func rsa_signature(algorithm: HMACAlgorithm, key: NSData) -> String? {
        let privkey: SecKey? = nil // TODO: get the SecKey format of the (private) key
        let msgbytes = UnsafePointer<UInt8>(self.bytes)
        let msglen = CC_LONG(self.length)

            case "RS256": return msg.rsa_signature(HMACAlgorithm.SHA256, key: key_raw)
            case "RS384": return msg.rsa_signature(HMACAlgorithm.SHA384, key: key_raw)
            case "RS512": return msg.rsa_signature(HMACAlgorithm.SHA512, key: key_raw)
            case "PS256": return msg.rsa_signature(HMACAlgorithm.SHA256, key: key_raw) // TODO: convert PS to RS key
            case "PS384": return msg.rsa_signature(HMACAlgorithm.SHA384, key: key_raw)
            case "PS512": return msg.rsa_signature(HMACAlgorithm.SHA512, key: key_raw)
            default:      return nil
            }
        }
