diff --git a/auth/jwt/coverage_test.go b/auth/jwt/coverage_test.go
index 059491e..428c3c3 100644
--- a/auth/jwt/coverage_test.go
+++ b/auth/jwt/coverage_test.go
@@ -808,7 +808,7 @@ func TestCov_KeyType(t *testing.T) {
 		{fakeKey{}, ""},
 	}
 	for _, tt := range tests {
-		pk := PublicKey{Key: tt.key}
+		pk := PublicKey{Pub: tt.key}
 		if got := pk.KeyType(); got != tt.expect {
 			t.Errorf("KeyType(%T)=%q want %q", tt.key, got, tt.expect)
 		}
@@ -934,7 +934,7 @@ func TestCov_Thumbprint(t *testing.T) {
 		})
 	}
 	t.Run("unsupported", func(t *testing.T) {
-		pk := PublicKey{Key: fakeKey{}}
+		pk := PublicKey{Pub: fakeKey{}}
 		_, err := pk.Thumbprint()
 		if !errors.Is(err, ErrUnsupportedKeyType) {
 			t.Fatalf("expected ErrUnsupportedKeyType, got %v", err)
@@ -963,7 +963,7 @@ func TestCov_PrivateKey_PublicKey(t *testing.T) {
 	})
 	t.Run("bad_signer", func(t *testing.T) {
 		// signer whose Public() returns a non-CryptoPublicKey
-		pk := &PrivateKey{privKey: fakeSigner{pub: "not a key"}}
+		pk := &PrivateKey{Priv: fakeSigner{pub: "not a key"}}
 		_, err := pk.PublicKey()
 		if !errors.Is(err, ErrSanityFail) {
 			t.Fatalf("expected ErrSanityFail, got %v", err)
@@ -980,8 +980,8 @@ func TestCov_NewPrivateKey(t *testing.T) {
 		t.Fatal("expected auto KID")
 	}
 	// Should be Ed25519
-	if _, ok := pk.privKey.(ed25519.PrivateKey); !ok {
-		t.Fatalf("expected Ed25519, got %T", pk.privKey)
+	if _, ok := pk.Priv.(ed25519.PrivateKey); !ok {
+		t.Fatalf("expected Ed25519, got %T", pk.Priv)
 	}
 }
 
@@ -1294,7 +1294,7 @@ func TestCov_toPublicKeyOps(t *testing.T) {
 }
 
 func TestCov_encode_Unsupported(t *testing.T) {
-	_, err := encode(PublicKey{Key: fakeKey{}})
+	_, err := encode(PublicKey{Pub: fakeKey{}})
 	if !errors.Is(err, ErrUnsupportedKeyType) {
 		t.Fatalf("expected ErrUnsupportedKeyType, got %v", err)
 	}
@@ -1304,8 +1304,8 @@ func TestCov_encodePrivate_Unsupported(t *testing.T) {
 	// Signer whose Public() returns a real ed25519 key but signer type is custom
 	edKey := mustEdKey(t)
 	pk := PrivateKey{
-		privKey: fakeSigner{pub: edKey.Public()},
-		KID:     "test",
+		Priv: fakeSigner{pub: edKey.Public()},
+		KID:  "test",
 	}
 	_, err := encodePrivate(pk)
 	if !errors.Is(err, ErrUnsupportedKeyType) {
@@ -1316,7 +1316,7 @@ func TestCov_encodePrivate_Unsupported(t *testing.T) {
 func TestCov_encodePrivate_RSA_NoPrimes(t *testing.T) {
 	rsaKey := mustRSAKey(t)
 	rsaKey.Primes = nil // remove primes
-	pk := PrivateKey{privKey: rsaKey, KID: "test"}
+	pk := PrivateKey{Priv: rsaKey, KID: "test"}
 	rk, err := encodePrivate(pk)
 	if err != nil {
 		t.Fatal(err)
@@ -2690,7 +2690,7 @@ func TestCov_PublicKey_MarshalJSON(t *testing.T) {
 	}
 
 	// Error path: unsupported key
-	bad := PublicKey{Key: fakeKey{}}
+	bad := PublicKey{Pub: fakeKey{}}
 	_, err = json.Marshal(bad)
 	if err == nil {
 		t.Fatal("expected error for unsupported key")
@@ -2847,7 +2847,7 @@ func TestCov_decodeOne_RSA(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if pk.Key == nil {
+	if pk.Pub == nil {
 		t.Fatal("expected key")
 	}
 }
@@ -2869,7 +2869,7 @@ func TestCov_decodePrivate_RSA(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if priv.privKey == nil {
+	if priv.Priv == nil {
 		t.Fatal("expected private key")
 	}
 }
@@ -2884,7 +2884,7 @@ func TestCov_decodePrivate_EC(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if priv.privKey == nil {
+	if priv.Priv == nil {
 		t.Fatal("expected private key")
 	}
 }
diff --git a/auth/jwt/jwk.go b/auth/jwt/jwk.go
index 04b08d2..d116c28 100644
--- a/auth/jwt/jwk.go
+++ b/auth/jwt/jwk.go
@@ -33,9 +33,9 @@ type CryptoPublicKey interface {
 //
 // PublicKey is the in-memory representation of a JWK.
 // [PublicKey.KeyType] returns the JWK kty string ("EC", "RSA", or "OKP").
-// To access the raw Go key, type-switch on Key:
+// To access the raw Go key, type-switch on Pub:
 //
-//	switch key := pk.Key.(type) {
+//	switch key := pk.Pub.(type) {
 //	case *ecdsa.PublicKey:  // ...
 //	case *rsa.PublicKey:    // ...
 //	case ed25519.PublicKey: // ...
@@ -44,7 +44,7 @@ type CryptoPublicKey interface {
 // For signing keys, use [PrivateKey] instead - it holds the [crypto.Signer]
 // and derives a PublicKey on demand.
 type PublicKey struct {
-	Key    CryptoPublicKey
+	Pub    CryptoPublicKey
 	KID    string
 	Use    string
 	Alg    string
@@ -54,9 +54,9 @@ type PublicKey struct {
 // KeyType returns the JWK "kty" string for the key: "EC", "RSA", or "OKP".
 // Returns "" if the key type is unrecognized.
 //
-// To access the underlying Go key, use a type switch on Key:
+// To access the underlying Go key, use a type switch on Pub:
 //
-//	switch key := k.Key.(type) {
+//	switch key := k.Pub.(type) {
 //	case *ecdsa.PublicKey:  // kty "EC"
 //	    // key is *ecdsa.PublicKey
 //	case *rsa.PublicKey:    // kty "RSA"
@@ -67,7 +67,7 @@ type PublicKey struct {
 //	    // unrecognized key type
 //	}
 func (k PublicKey) KeyType() string {
-	switch k.Key.(type) {
+	switch k.Pub.(type) {
 	case *ecdsa.PublicKey:
 		return "EC"
 	case *rsa.PublicKey:
@@ -163,11 +163,11 @@ func (k PublicKey) Thumbprint() (string, error) {
 //
 // Use [FromPrivateKey] to construct.
 type PrivateKey struct {
-	privKey crypto.Signer
-	KID     string
-	Use     string
-	Alg     string
-	KeyOps  []string
+	Priv   crypto.Signer
+	KID    string
+	Use    string
+	Alg    string
+	KeyOps []string
 }
 
 // PublicKey derives the [PublicKey] for this signing key.
@@ -179,12 +179,12 @@ type PrivateKey struct {
 // known CryptoPublicKey type - this should never happen for keys created
 // through this library.
 func (k *PrivateKey) PublicKey() (*PublicKey, error) {
-	pub, ok := k.privKey.Public().(CryptoPublicKey)
+	pub, ok := k.Priv.Public().(CryptoPublicKey)
 	if !ok {
-		return nil, fmt.Errorf("%w: private key type %T did not produce a known public key type", ErrSanityFail, k.privKey)
+		return nil, fmt.Errorf("%w: private key type %T did not produce a known public key type", ErrSanityFail, k.Priv)
 	}
 	return &PublicKey{
-		Key:    pub,
+		Pub:    pub,
 		KID:    k.KID,
 		Use:    k.Use,
 		Alg:    k.Alg,
@@ -242,7 +242,7 @@ func NewPrivateKey() (*PrivateKey, error) {
 	if err != nil {
 		return nil, fmt.Errorf("NewPrivateKey: generate Ed25519 key: %w", err)
 	}
-	pk := &PrivateKey{privKey: priv}
+	pk := &PrivateKey{Priv: priv}
 	kid, err := pk.Thumbprint()
 	if err != nil {
 		return nil, fmt.Errorf("NewPrivateKey: compute thumbprint: %w", err)
@@ -313,7 +313,7 @@ type WellKnownJWKs struct {
 func encode(k PublicKey) (rawKey, error) {
 	rk := rawKey{KID: k.KID, Use: k.Use, Alg: k.Alg, KeyOps: k.KeyOps}
 
-	switch key := k.Key.(type) {
+	switch key := k.Pub.(type) {
 	case *ecdsa.PublicKey:
 		ci, err := ecInfo(key.Curve)
 		if err != nil {
@@ -343,7 +343,7 @@ func encode(k PublicKey) (rawKey, error) {
 		return rk, nil
 
 	default:
-		return rawKey{}, fmt.Errorf("%T: %w", k.Key, ErrUnsupportedKeyType)
+		return rawKey{}, fmt.Errorf("%T: %w", k.Pub, ErrUnsupportedKeyType)
 	}
 }
 
@@ -360,7 +360,7 @@ func encodePrivate(k PrivateKey) (rawKey, error) {
 		return rawKey{}, err
 	}
 
-	switch priv := k.privKey.(type) {
+	switch priv := k.Priv.(type) {
 	case *ecdsa.PrivateKey:
 		dBytes, err := priv.Bytes()
 		if err != nil {
@@ -385,7 +385,7 @@ func encodePrivate(k PrivateKey) (rawKey, error) {
 		rk.D = base64.RawURLEncoding.EncodeToString(priv.Seed())
 
 	default:
-		return rawKey{}, fmt.Errorf("%T: %w", k.privKey, ErrUnsupportedKeyType)
+		return rawKey{}, fmt.Errorf("%T: %w", k.Priv, ErrUnsupportedKeyType)
 	}
 
 	return rk, nil
@@ -402,7 +402,7 @@ func FromPublicKey(pub crypto.PublicKey) (*PublicKey, error) {
 		return nil, fmt.Errorf("%T: %w", pub, ErrUnsupportedKeyType)
 	}
 
-	pk := &PublicKey{Key: cpk}
+	pk := &PublicKey{Pub: cpk}
 
 	// Derive Alg from key type.
 	switch key := pub.(type) {
@@ -441,7 +441,7 @@ func FromPrivateKey(signer crypto.Signer, kid string) (*PrivateKey, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &PrivateKey{privKey: signer, KID: kid, Alg: alg}, nil
+	return &PrivateKey{Priv: signer, KID: kid, Alg: alg}, nil
 }
 
 // decodeOne parses a single rawKey wire struct into a [PublicKey].
@@ -579,13 +579,13 @@ func decodePrivate(kj rawKey) (*PrivateKey, error) {
 // newPublicKey creates a [PublicKey] from a crypto key, copying metadata
 // (KID, Use, Alg, KeyOps) from the rawKey.
 func (kj rawKey) newPublicKey(key CryptoPublicKey) *PublicKey {
-	return &PublicKey{Key: key, KID: kj.KID, Use: kj.Use, Alg: kj.Alg, KeyOps: kj.KeyOps}
+	return &PublicKey{Pub: key, KID: kj.KID, Use: kj.Use, Alg: kj.Alg, KeyOps: kj.KeyOps}
 }
 
 // newPrivateKey creates a [PrivateKey] from a crypto.Signer, copying metadata
 // (KID, Use, Alg, KeyOps) from the rawKey.
 func (kj rawKey) newPrivateKey(signer crypto.Signer) *PrivateKey {
-	return &PrivateKey{privKey: signer, KID: kj.KID, Use: kj.Use, Alg: kj.Alg, KeyOps: kj.KeyOps}
+	return &PrivateKey{Priv: signer, KID: kj.KID, Use: kj.Use, Alg: kj.Alg, KeyOps: kj.KeyOps}
 }
 
 // decodeB64Field decodes a base64url-encoded JWK field value, returning a
diff --git a/auth/jwt/keyfile/keyfile_test.go b/auth/jwt/keyfile/keyfile_test.go
index 4003bc1..91ed062 100644
--- a/auth/jwt/keyfile/keyfile_test.go
+++ b/auth/jwt/keyfile/keyfile_test.go
@@ -228,7 +228,7 @@ func TestParsePublicJWK(t *testing.T) {
 	if pk.KID == "" {
 		t.Error("KID should be set")
 	}
-	if pk.Key == nil {
+	if pk.Pub == nil {
 		t.Error("Key should be set")
 	}
 }
diff --git a/auth/jwt/sign.go b/auth/jwt/sign.go
index 22674b0..b8aef40 100644
--- a/auth/jwt/sign.go
+++ b/auth/jwt/sign.go
@@ -65,13 +65,13 @@ func NewSigner(keys []*PrivateKey, retiredKeys ...PublicKey) (*Signer, error) {
 	// Copy so the caller can't mutate after construction.
 	ss := make([]PrivateKey, len(keys))
 	for i, k := range keys {
-		if k == nil || k.privKey == nil {
+		if k == nil || k.Priv == nil {
 			return nil, fmt.Errorf("NewSigner: key[%d]: %w", i, ErrNoSigningKey)
 		}
 		ss[i] = *k
 
 		// Derive algorithm from key type; validate caller's Alg if already set.
-		alg, _, _, err := signingParams(ss[i].privKey)
+		alg, _, _, err := signingParams(ss[i].Priv)
 		if err != nil {
 			return nil, fmt.Errorf("NewSigner: key[%d]: %w", i, err)
 		}
@@ -168,11 +168,11 @@ func (s *Signer) SignJWT(jws SignableJWT) error {
 		pk = s.nextKey()
 		hdr.KID = pk.KID
 	}
-	if pk.privKey == nil {
+	if pk.Priv == nil {
 		return fmt.Errorf("kid %q: %w", pk.KID, ErrNoSigningKey)
 	}
 
-	alg, hash, ecKeySize, err := signingParams(pk.privKey)
+	alg, hash, ecKeySize, err := signingParams(pk.Priv)
 	if err != nil {
 		return err
 	}
@@ -189,7 +189,7 @@ func (s *Signer) SignJWT(jws SignableJWT) error {
 
 	input := signingInputBytes(jws.GetProtected(), jws.GetPayload())
 
-	sig, err := signBytes(pk.privKey, alg, hash, ecKeySize, input)
+	sig, err := signBytes(pk.Priv, alg, hash, ecKeySize, input)
 	if err != nil {
 		return err
 	}
@@ -214,13 +214,13 @@ func (s *Signer) SignJWT(jws SignableJWT) error {
 // produces an empty payload segment (used by ACME POST-as-GET).
 func (s *Signer) SignRaw(hdr Header, payload []byte) (*RawJWT, error) {
 	pk := s.nextKey()
-	if pk.privKey == nil {
+	if pk.Priv == nil {
 		return nil, fmt.Errorf("kid %q: %w", pk.KID, ErrNoSigningKey)
 	}
 
 	rfc := hdr.GetRFCHeader()
 
-	alg, hash, ecKeySize, err := signingParams(pk.privKey)
+	alg, hash, ecKeySize, err := signingParams(pk.Priv)
 	if err != nil {
 		return nil, err
 	}
@@ -239,7 +239,7 @@ func (s *Signer) SignRaw(hdr Header, payload []byte) (*RawJWT, error) {
 
 	input := signingInputBytes([]byte(protectedB64), []byte(payloadB64))
 
-	sig, err := signBytes(pk.privKey, alg, hash, ecKeySize, input)
+	sig, err := signBytes(pk.Priv, alg, hash, ecKeySize, input)
 	if err != nil {
 		return nil, err
 	}
@@ -328,21 +328,21 @@ func signBytes(signer crypto.Signer, alg string, hash crypto.Hash, ecKeySize int
 // validateSigningKey performs a test sign+verify round-trip to catch bad
 // keys at construction time rather than on first use.
 func validateSigningKey(pk *PrivateKey, pub *PublicKey) error {
-	alg, hash, ecKeySize, err := signingParams(pk.privKey)
+	alg, hash, ecKeySize, err := signingParams(pk.Priv)
 	if err != nil {
 		return err
 	}
 
 	testInput := []byte("jwt-key-validation")
 
-	sig, err := signBytes(pk.privKey, alg, hash, ecKeySize, testInput)
+	sig, err := signBytes(pk.Priv, alg, hash, ecKeySize, testInput)
 	if err != nil {
 		return fmt.Errorf("test sign: %w", err)
 	}
 
 	// Verify against the public key.
 	h := RFCHeader{Alg: alg, KID: pk.KID}
-	if err := verifyOneKey(h, pub.Key, testInput, sig); err != nil {
+	if err := verifyOneKey(h, pub.Pub, testInput, sig); err != nil {
 		return fmt.Errorf("test verify: %w", err)
 	}
 	return nil
diff --git a/auth/jwt/verify.go b/auth/jwt/verify.go
index dc6c5e4..cdd8345 100644
--- a/auth/jwt/verify.go
+++ b/auth/jwt/verify.go
@@ -60,7 +60,7 @@ func NewVerifier(keys []PublicKey) (*Verifier, error) {
 		entries := seen[k.KID]
 		dup := false
 		for _, e := range entries {
-			if e.key.Equal(k.Key) {
+			if e.key.Equal(k.Pub) {
 				dup = true
 				break
 			}
@@ -68,7 +68,7 @@ func NewVerifier(keys []PublicKey) (*Verifier, error) {
 		if dup {
 			continue // identical key material, skip
 		}
-		seen[k.KID] = append(entries, seenEntry{key: k.Key, index: len(deduped)})
+		seen[k.KID] = append(entries, seenEntry{key: k.Pub, index: len(deduped)})
 		deduped = append(deduped, k)
 	}
 	return &Verifier{
@@ -136,7 +136,7 @@ func (v *Verifier) Verify(jws VerifiableJWT) error {
 	// for the token's algorithm) since it's more informative.
 	var bestErr error
 	for _, pk := range candidates {
-		err := verifyOneKey(h, pk.Key, signingInput, sig)
+		err := verifyOneKey(h, pk.Pub, signingInput, sig)
 		if err == nil {
 			return nil
 		}