diff --git a/src/security/key.hpp b/src/security/key.hpp
index b3e4f96..31d7fe7 100644
--- a/src/security/key.hpp
+++ b/src/security/key.hpp
@@ -47,6 +47,7 @@
 public:
   friend class Identity;
   friend class KeyContainer;
+  friend class KeyChain;
 
 public:
   /**
@@ -86,6 +87,36 @@
   getPublicKey() const;
 
   /**
+   * @brief Get a certificate.
+   *
+   * @return the certificate
+   * @throws Pib::Error if the certificate does not exist.
+   */
+  IdentityCertificate
+  getCertificate(const Name& certName) const;
+
+  /// @brief Get all the certificates for this key.
+  const CertificateContainer&
+  getCertificates() const;
+
+  /**
+   * @brief Get the default certificate for this Key.
+   *
+   * @throws Pib::Error if the default certificate does not exist.
+   */
+  const IdentityCertificate&
+  getDefaultCertificate() const;
+
+  /// @brief Check if the Key instance is valid
+  operator bool() const;
+
+  /// @brief Check if the Key instance is invalid
+  bool
+  operator!() const;
+
+NDN_CXX_PUBLIC_WITH_TESTS_ELSE_PRIVATE: // write operations should be private
+
+  /**
    * @brief Add a certificate.
    *
    * @param certificate The certificate to add.
@@ -102,19 +133,6 @@
   removeCertificate(const Name& certName);
 
   /**
-   * @brief Get a certificate.
-   *
-   * @return the certificate
-   * @throws Pib::Error if the certificate does not exist.
-   */
-  IdentityCertificate
-  getCertificate(const Name& certName);
-
-  /// @brief Get all the certificates for this key.
-  CertificateContainer
-  getCertificates();
-
-  /**
    * @brief Set the default certificate.
    *
    * @param certName The name of the default certificate of the key.
@@ -136,21 +154,6 @@
   const IdentityCertificate&
   setDefaultCertificate(const IdentityCertificate& certificate);
 
-  /**
-   * @brief Get the default certificate for this Key.
-   *
-   * @throws Pib::Error if the default certificate does not exist.
-   */
-  const IdentityCertificate&
-  getDefaultCertificate();
-
-  /// @brief Check if the Key instance is valid
-  operator bool() const;
-
-  /// @brief Check if the Key instance is invalid
-  bool
-  operator!() const;
-
 NDN_CXX_PUBLIC_WITH_TESTS_ELSE_PRIVATE:
   /**
    * @brief Create a Key with @p identityName and @p keyId.
@@ -189,11 +192,11 @@
   Name m_keyName;
   PublicKey m_key;
 
-  bool m_hasDefaultCertificate;
-  IdentityCertificate m_defaultCertificate;
+  mutable bool m_hasDefaultCertificate;
+  mutable IdentityCertificate m_defaultCertificate;
 
-  bool m_needRefreshCerts;
-  CertificateContainer m_certificates;
+  mutable bool m_needRefreshCerts;
+  mutable CertificateContainer m_certificates;
 
   shared_ptr<PibImpl> m_impl;
 };