diff --git a/src/security/pib/key-container.hpp b/src/security/pib/key-container.hpp
index a593132..45d9127 100644
--- a/src/security/pib/key-container.hpp
+++ b/src/security/pib/key-container.hpp
@@ -23,6 +23,7 @@
 #define NDN_SECURITY_PIB_KEY_CONTAINER_HPP
 
 #include <set>
+#include <unordered_map>
 #include "key.hpp"
 
 namespace ndn {
@@ -31,13 +32,25 @@
 
 class PibImpl;
 
-/// @brief A handler to search or enumerate keys of an identity.
-class KeyContainer
+namespace detail {
+class KeyImpl;
+class IdentityImpl;
+} // namespace detail
+
+/**
+ * @brief Container of keys of an identity
+ *
+ * The container is used to search/enumerate keys of an identity.
+ * The container can be created only by detail::IdentityImpl.
+ */
+class KeyContainer : noncopyable
 {
 public:
-  class const_iterator
+  class const_iterator : public std::iterator<std::forward_iterator_tag, const Key>
   {
   public:
+    const_iterator();
+
     Key
     operator*();
 
@@ -54,12 +67,11 @@
     operator!=(const const_iterator& other);
 
   private:
-    const_iterator(const Name& identity, std::set<Name>::const_iterator it, shared_ptr<PibImpl> impl);
+    const_iterator(std::set<Name>::const_iterator it, const KeyContainer& container);
 
   private:
-    Name m_identity;
     std::set<Name>::const_iterator m_it;
-    shared_ptr<PibImpl> m_impl;
+    const KeyContainer* m_container;
 
     friend class KeyContainer;
   };
@@ -67,10 +79,6 @@
   typedef const_iterator iterator;
 
 public:
-  KeyContainer();
-
-  KeyContainer(const Name& identity, std::set<Name>&& keyNames, shared_ptr<PibImpl> impl);
-
   const_iterator
   begin() const;
 
@@ -83,10 +91,63 @@
   size_t
   size() const;
 
+  /**
+   * @brief Add @p key of @p keyLen bytes with @p keyName into the container
+   * @throw std::invalid_argument @p keyName does not match the identity
+   */
+  Key
+  add(const uint8_t* key, size_t keyLen, const Name& keyName);
+
+  /**
+   * @brief Remove a key with @p keyName from the container
+   * @throw std::invalid_argument @p keyName does not match the identity
+   */
+  void
+  remove(const Name& keyName);
+
+  /**
+   * @brief Get a key with @p keyName from the container
+   * @throw std::invalid_argument @p keyName does not match the identity
+   * @throw Pib::Error the key does not exist
+   */
+  Key
+  get(const Name& keyName) const;
+
+  /**
+   * @brief Check if the container is consistent with the backend storage
+   *
+   * @note this method is heavyweight and should be used in debugging mode only.
+   */
+  bool
+  isConsistent() const;
+
+NDN_CXX_PUBLIC_WITH_TESTS_ELSE_PRIVATE:
+  /**
+   * @brief Create key container for @p identity
+   * @param impl The PIB backend implementation.
+   */
+  KeyContainer(const Name& identity, shared_ptr<PibImpl> impl);
+
+  const std::set<Name>&
+  getKeyNames() const
+  {
+    return m_keyNames;
+  }
+
+  const std::unordered_map<Name, shared_ptr<detail::KeyImpl>>&
+  getLoadedKeys() const
+  {
+    return m_keys;
+  }
+
 private:
   Name m_identity;
   std::set<Name> m_keyNames;
+  /// @brief Cache of loaded detail::KeyImpl.
+  mutable std::unordered_map<Name, shared_ptr<detail::KeyImpl>> m_keys;
+
   shared_ptr<PibImpl> m_impl;
+  friend class detail::IdentityImpl;
 };
 
 } // namespace pib