diff --git a/ndn-cpp/key-chain.cpp b/ndn-cpp/key-chain.cpp
index 36e83eb..c2a10ff 100644
--- a/ndn-cpp/key-chain.cpp
+++ b/ndn-cpp/key-chain.cpp
@@ -66,7 +66,7 @@
  * @param dataLength The length of data.
  * @param digest A pointer to a buffer of size SHA256_DIGEST_LENGTH to receive the data.
  */
-static void digestSha256(unsigned char *data, unsigned int dataLength, unsigned char *digest)
+static void digestSha256(const unsigned char *data, unsigned int dataLength, unsigned char *digest)
 {
   SHA256_CTX sha256;
   SHA256_Init(&sha256);
@@ -80,7 +80,7 @@
  * @param dataLength
  * @param digest
  */
-static void setSha256(unsigned char *data, unsigned int dataLength, vector<unsigned char> &digest)
+static void setSha256(const unsigned char *data, unsigned int dataLength, vector<unsigned char> &digest)
 {
   unsigned char digestBuffer[SHA256_DIGEST_LENGTH];
   digestSha256(data, dataLength, digestBuffer);
@@ -109,12 +109,16 @@
   digestSha256(encoder.output.array + signedFieldsBeginOffset, signedFieldsEndOffset - signedFieldsBeginOffset, digest);
 }
 
-void KeyChain::defaultSign(Data &data)
+void KeyChain::sign
+  (Data &data, const unsigned char *publicKeyDer, unsigned int publicKeyDerLength, 
+   const unsigned char *privateKeyDer, unsigned int privateKeyDerLength)
 {
   // Set the public key.
-  setSha256(DEFAULT_PUBLIC_KEY_DER, sizeof(DEFAULT_PUBLIC_KEY_DER), data.getSignedInfo().getPublisherPublicKeyDigest().getPublisherPublicKeyDigest());
+  setSha256(publicKeyDer, publicKeyDerLength, data.getSignedInfo().getPublisherPublicKeyDigest().getPublisherPublicKeyDigest());
   data.getSignedInfo().getKeyLocator().setType(ndn_KeyLocatorType_KEY);
-  data.getSignedInfo().getKeyLocator().setKeyOrCertificate(DEFAULT_PUBLIC_KEY_DER, sizeof(DEFAULT_PUBLIC_KEY_DER));
+  data.getSignedInfo().getKeyLocator().setKeyOrCertificate(publicKeyDer, publicKeyDerLength);
+  // Clear the signature so we don't encode it below.
+  data.getSignature().clear();
 
   // Sign the fields.
   unsigned char dataFieldsDigest[SHA256_DIGEST_LENGTH];
@@ -122,8 +126,8 @@
   // TODO: use RSA_size to get the proper size of the signature buffer.
   unsigned char signature[1000];
   unsigned int signatureLength;
-  const unsigned char *keyPointer = DEFAULT_PRIVATE_KEY_DER;
-  RSA *privateKey = d2i_RSAPrivateKey(NULL, &keyPointer, sizeof(DEFAULT_PRIVATE_KEY_DER));
+  const unsigned char *keyPointer = privateKeyDer;
+  RSA *privateKey = d2i_RSAPrivateKey(NULL, &keyPointer, privateKeyDerLength);
   if (!privateKey)
     throw std::runtime_error("Error decoding private key in d2i_RSAPrivateKey");
   int success = RSA_sign(NID_sha256, dataFieldsDigest, sizeof(dataFieldsDigest), signature, &signatureLength, privateKey);
@@ -135,4 +139,9 @@
   data.getSignature().setSignature(signature, signatureLength);
 }
 
+void KeyChain::defaultSign(Data &data)
+{
+  sign(data, DEFAULT_PUBLIC_KEY_DER, sizeof(DEFAULT_PUBLIC_KEY_DER), DEFAULT_PRIVATE_KEY_DER, sizeof(DEFAULT_PRIVATE_KEY_DER));
+}
+
 }
diff --git a/ndn-cpp/key-chain.hpp b/ndn-cpp/key-chain.hpp
index 97991e9..8de7a62 100644
--- a/ndn-cpp/key-chain.hpp
+++ b/ndn-cpp/key-chain.hpp
@@ -13,14 +13,25 @@
 class KeyChain {
 public:
   /**
-   * In data, set the signed info publisher public key digest and key locator key to the default public key and set the 
-   * signature using the default private key.
+   * In data, set the signed info publisher public key digest and key locator key to the public key and set the 
+   * signature using the private key.
    * Note: the caller must make sure the timestamp is correct, for example with 
    * data.getSignedInfo().setTimestampMilliseconds(time(NULL) * 1000.0).
-   * @param data The Data object to sign and set the signature.
+   * @param data The Data object to sign and set the key and signature.
+   * @param publicKeyDer A pointer to a buffer with the DER-encoded public key.
+   * @param publicKeyDerLength The number of bytes in publicKeyDer.
+   * @param privateKeyDer A pointer to a buffer with the DER-encoded private key.
+   * @param privateKeyDerLength The number of bytes in privateKeyDer.
+   */
+  static void sign
+    (Data &data, const unsigned char *publicKeyDer, unsigned int publicKeyDerLength, 
+     const unsigned char *privateKeyDer, unsigned int privateKeyDerLength);
+
+  /**
+   * Call sign with the default public and private keys.
+   * @param data
    */
   static void defaultSign(Data &data);
-
 };
 
 }