diff --git a/commons/src/api/ca.rs b/commons/src/api/ca.rs
index 57ac7ed5..37ef749c 100644
--- a/commons/src/api/ca.rs
+++ b/commons/src/api/ca.rs
@@ -9,7 +9,6 @@ use std::{fmt, ops, str};
 
 use bytes::Bytes;
 use chrono::Duration;
-use serde::de;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 
 use rpki::cert::Cert;
@@ -201,60 +200,6 @@ impl ChildCaDetails {
     }
 }
 
-/// This type defines a reference to PublicKey for easy storage and lookup.
-#[derive(Clone, Debug, Display, Eq, Hash, PartialEq)]
-pub struct KeyRef(KeyIdentifier);
-
-impl From<&KeyIdentifier> for KeyRef {
-    fn from(ki: &KeyIdentifier) -> Self {
-        KeyRef(*ki)
-    }
-}
-
-impl From<KeyIdentifier> for KeyRef {
-    fn from(ki: KeyIdentifier) -> Self {
-        KeyRef(ki)
-    }
-}
-
-impl From<&KeyRef> for KeyIdentifier {
-    fn from(kr: &KeyRef) -> Self {
-        kr.0
-    }
-}
-
-impl From<KeyRef> for KeyIdentifier {
-    fn from(kr: KeyRef) -> Self {
-        kr.0
-    }
-}
-
-impl From<&Cert> for KeyRef {
-    fn from(c: &Cert) -> Self {
-        KeyRef(c.subject_key_identifier())
-    }
-}
-
-impl Serialize for KeyRef {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        self.0.to_string().serialize(serializer)
-    }
-}
-
-impl<'de> Deserialize<'de> for KeyRef {
-    fn deserialize<D>(deserializer: D) -> Result<KeyRef, D::Error>
-    where
-        D: Deserializer<'de>,
-    {
-        let string = String::deserialize(deserializer)?;
-        let ki = KeyIdentifier::from_str(&string).map_err(de::Error::custom)?;
-        Ok(KeyRef(ki))
-    }
-}
-
 //------------ ChildResources ------------------------------------------------
 
 /// This type defines the resource entitlements for a child CA within
@@ -267,7 +212,7 @@ pub struct ChildResources {
     resources: ResourceSet,
     shrink_pending: Option<Time>,
     not_after: Time,
-    certs: HashMap<KeyRef, IssuedCert>,
+    certs: HashMap<KeyIdentifier, IssuedCert>,
 }
 
 impl ChildResources {
@@ -312,13 +257,12 @@ impl ChildResources {
         self.certs.values()
     }
 
-    pub fn certs(&self) -> &HashMap<KeyRef, IssuedCert> {
+    pub fn certs(&self) -> &HashMap<KeyIdentifier, IssuedCert> {
         &self.certs
     }
 
     pub fn cert(&self, key_id: &KeyIdentifier) -> Option<&IssuedCert> {
-        let key_ref = KeyRef::from(key_id);
-        self.certs.get(&key_ref)
+        self.certs.get(key_id)
     }
 
     pub fn add_cert(&mut self, cert: IssuedCert) {
@@ -328,8 +272,8 @@ impl ChildResources {
         self.not_after = cert.cert().validity().not_after();
 
         // Update the certificate for this key, or insert it for a new key.
-        let key_ref = KeyRef::from(cert.cert());
-        self.certs.insert(key_ref, cert);
+        self.certs
+            .insert(cert.cert().subject_key_identifier(), cert);
 
         // If a shrink was pending, check that it's still applicable.
         if self.shrink_pending.is_some()
@@ -348,8 +292,7 @@ impl ChildResources {
     }
 
     pub fn revoke(&mut self, key_id: &KeyIdentifier) {
-        let key_ref = KeyRef::from(key_id);
-        self.certs.remove(&key_ref);
+        self.certs.remove(&key_id);
     }
 }
 
@@ -885,7 +828,7 @@ pub struct ObjectName(String);
 
 impl ObjectName {
     pub fn new(ki: &KeyIdentifier, extension: &str) -> Self {
-        ObjectName(format!("{}.{}", KeyRef::from(ki), extension))
+        ObjectName(format!("{}.{}", ki, extension))
     }
 }
 
@@ -962,7 +905,8 @@ impl CurrentObjects {
     }
 
     pub fn deactivate(&mut self) {
-        self.0.retain(|name, _| name.ends_with(".mft") || name.ends_with(".crl"))
+        self.0
+            .retain(|name, _| name.ends_with(".mft") || name.ends_with(".crl"))
     }
 
     pub fn is_empty(&self) -> bool {
diff --git a/daemon/src/ca/certauth.rs b/daemon/src/ca/certauth.rs
index 587934d7..5aefe4a5 100644
--- a/daemon/src/ca/certauth.rs
+++ b/daemon/src/ca/certauth.rs
@@ -787,9 +787,8 @@ impl<S: Signer> CertAuth<S> {
                             class_name, child_handle
                         );
                         // Remove resource set and revoke all certs
-                        for (keyref, issued) in child_resources.certs().iter() {
-                            let revocation =
-                                RevocationResponse::new(class_name.clone(), keyref.into());
+                        for (key_id, issued) in child_resources.certs().iter() {
+                            let revocation = RevocationResponse::new(class_name.clone(), *key_id);
                             events.push(EvtDet::ChildKeyRevoked(child_handle.clone(), revocation));
                             removed.push(issued.cert())
                         }
diff --git a/daemon/src/ca/error.rs b/daemon/src/ca/error.rs
index d7e2548b..118d8737 100644
--- a/daemon/src/ca/error.rs
+++ b/daemon/src/ca/error.rs
@@ -1,8 +1,9 @@
 use std::fmt::Display;
 use std::{fmt, io};
 
+use rpki::crypto::KeyIdentifier;
+
 use krill_commons::api::admin::Handle;
-use krill_commons::api::ca::KeyRef;
 use krill_commons::api::RouteAuthorization;
 use krill_commons::eventsourcing::AggregateStoreError;
 use krill_commons::remote::rfc6492;
@@ -67,7 +68,7 @@ pub enum Error {
     InvalidKeyStatus,
 
     #[display(fmt = "No key held by CA matching issued certificate: {}", _0)]
-    NoKeyMatch(KeyRef),
+    NoKeyMatch(KeyIdentifier),
 
     #[display(fmt = "Signing issue: {}", _0)]
     SignerError(String),
diff --git a/daemon/src/ca/rc.rs b/daemon/src/ca/rc.rs
index 5f516fcf..4f8855ce 100644
--- a/daemon/src/ca/rc.rs
+++ b/daemon/src/ca/rc.rs
@@ -9,9 +9,9 @@ use rpki::uri;
 use rpki::x509::Time;
 
 use krill_commons::api::ca::{
-    CertifiedKey, CurrentObjects, KeyRef, ObjectsDelta, OldKey, PendingKey, PublicationDelta,
-    RcvdCert, RepoInfo, ResourceClassInfo, ResourceClassKeysInfo, ResourceClassName, ResourceSet,
-    Revocation, RevokedObject,
+    CertifiedKey, CurrentObjects, ObjectsDelta, OldKey, PendingKey, PublicationDelta, RcvdCert,
+    RepoInfo, ResourceClassInfo, ResourceClassKeysInfo, ResourceClassName, ResourceSet, Revocation,
+    RevokedObject,
 };
 use krill_commons::api::{
     EntitlementClass, IssuanceRequest, RequestResourceLimit, RevocationRequest, RouteAuthorization,
@@ -470,14 +470,17 @@ impl ResourceClass {
 
         let authorizations: Vec<RouteAuthorization> = self.roas.authorizations().cloned().collect();
 
-        res.push(self.keys.keyroll_activate(rcn.clone(), self.parent_rc_name.clone(), signer)?);
+        res.push(
+            self.keys
+                .keyroll_activate(rcn.clone(), self.parent_rc_name.clone(), signer)?,
+        );
 
         res.append(&mut self.republish(
             authorizations.as_slice(),
             repo_info,
             rcn,
             &PublishMode::KeyRollActivation,
-            signer
+            signer,
         )?);
 
         Ok(res)
@@ -760,7 +763,7 @@ impl ResourceClassKeys {
             }
         }
 
-        Err(ca::Error::NoKeyMatch(KeyRef::from(cert)))
+        Err(ca::Error::NoKeyMatch(cert.subject_key_identifier()))
     }
 
     fn update_received_cert<S: Signer>(
diff --git a/daemon/tests/ca_roas.rs b/daemon/tests/ca_roas.rs
index 41c416e9..8614d80c 100644
--- a/daemon/tests/ca_roas.rs
+++ b/daemon/tests/ca_roas.rs
@@ -76,7 +76,10 @@ fn ca_roas() {
         // And route3 should remain there during a roll.
         ca_roll_init(&child);
         wait_for_new_key(&child);
-        wait_for_published_objects(&child, &[crl_file, mft_file, crl_file, mft_file, route3_file]);
+        wait_for_published_objects(
+            &child,
+            &[crl_file, mft_file, crl_file, mft_file, route3_file],
+        );
 
         ca_roll_activate(&child);
         wait_for_key_roll_complete(&child);