diff --git a/src/clients/response.cpp b/src/clients/response.cpp
index 0bbc9de..b1c3865 100644
--- a/src/clients/response.cpp
+++ b/src/clients/response.cpp
@@ -43,7 +43,7 @@
 inline size_t
 Response::wireEncode(EncodingImpl<T>& block) const
 {
-  if (m_contentType == NDNS_BLOB) {
+  if (m_contentType == NDNS_BLOB || m_contentType == NDNS_KEY) {
     // Raw application content
     return block.prependBlock(m_appContent);
   }
@@ -66,7 +66,7 @@
 const Block
 Response::wireEncode() const
 {
-  if (m_contentType == NDNS_BLOB) {
+  if (m_contentType == NDNS_BLOB || m_contentType == NDNS_KEY) {
     return m_appContent;
   }
 
@@ -80,7 +80,7 @@
 void
 Response::wireDecode(const Block& wire)
 {
-  if (m_contentType == NDNS_BLOB) {
+  if (m_contentType == NDNS_BLOB || m_contentType == NDNS_KEY) {
     m_appContent = wire;
     return;
   }
@@ -137,7 +137,7 @@
 
   shared_ptr<Data> data = make_shared<Data>(name);
 
-  if (m_contentType != NDNS_BLOB) {
+  if (m_contentType != NDNS_BLOB && m_contentType != NDNS_KEY) {
     data->setContent(this->wireEncode());
   }
   else {
@@ -198,7 +198,7 @@
   if (tmp == false)
     return tmp;
 
-  if (m_contentType == NDNS_BLOB) {
+  if (m_contentType == NDNS_BLOB || m_contentType == NDNS_KEY) {
     return tmp && (getAppContent() == other.getAppContent());
   }
   else
@@ -215,7 +215,8 @@
      << " version=" << response.getVersion()
      << " freshnessPeriod=" << response.getFreshnessPeriod()
      << " NdnsContentType=" << response.getContentType();
-  if (response.getContentType() == NDNS_BLOB) {
+  if (response.getContentType() == NDNS_BLOB
+      || response.getContentType() == NDNS_KEY) {
     if (response.getAppContent().empty())
       os << " appContent=NULL";
     else
diff --git a/src/daemon/rrset-factory.cpp b/src/daemon/rrset-factory.cpp
index a75c650..9395f42 100644
--- a/src/daemon/rrset-factory.cpp
+++ b/src/daemon/rrset-factory.cpp
@@ -216,7 +216,7 @@
   Data data(name);
   data.setContent(cert.wireEncode());
 
-  setContentType(data, NDNS_BLOB, ttl);
+  setContentType(data, NDNS_KEY, ttl);
   sign(data);
   rrset.setData(data.wireEncode());
 
diff --git a/src/daemon/rrset-factory.hpp b/src/daemon/rrset-factory.hpp
index 8318bb8..e5165d3 100644
--- a/src/daemon/rrset-factory.hpp
+++ b/src/daemon/rrset-factory.hpp
@@ -107,8 +107,9 @@
   void
   sign(Data& data);
 
-  void setContentType(Data& data, NdnsContentType contentType,
-                      const time::seconds& ttl);
+  void
+  setContentType(Data& data, NdnsContentType contentType,
+                 const time::seconds& ttl);
 
 private:
   KeyChain& m_keyChain;
diff --git a/src/mgmt/management-tool.cpp b/src/mgmt/management-tool.cpp
index 0ddf57b..9ac19e5 100644
--- a/src/mgmt/management-tool.cpp
+++ b/src/mgmt/management-tool.cpp
@@ -345,11 +345,13 @@
     Data data(rrset.getData());
     Response re;
     re.fromData(zoneName, data);
-    int iteration = re.getContentType() == NDNS_BLOB || re.getContentType() == NDNS_AUTH ?
-                      1 : re.getRrs().size();
+    int iteration = re.getContentType() == NDNS_BLOB
+                    || re.getContentType() == NDNS_KEY
+                    || re.getContentType() == NDNS_AUTH ? 1 : re.getRrs().size();
+
     const std::vector<Block> &rrs = re.getRrs();
 
-    if (re.getContentType() != NDNS_BLOB) {
+    if (re.getContentType() != NDNS_BLOB && re.getContentType() != NDNS_KEY) {
       os << "; rrset=" << rrset.getLabel().toUri()
          << " type=" << rrset.getType().toUri()
          << " version=" << rrset.getVersion().toUri()
@@ -368,7 +370,7 @@
       os.width(typeWidth + 2);
       os << rrset.getType().toUri();
 
-      if (re.getContentType() != NDNS_BLOB) {
+      if (re.getContentType() != NDNS_BLOB && re.getContentType() != NDNS_KEY) {
         using namespace CryptoPP;
         if (rrset.getType() == label::TXT_RR_TYPE) {
           os.write(reinterpret_cast<const char*>(rrs[i].value()), rrs[i].value_size());
@@ -397,14 +399,15 @@
       }
     }
 
-    if (re.getContentType() == NDNS_BLOB) {
+    if (re.getContentType() == NDNS_BLOB || re.getContentType() == NDNS_KEY) {
       os.width();
       os << "; content-type=" << re.getContentType()
          << " version=" << rrset.getVersion().toUri()
          << " signed-by=" << data.getSignature().getKeyLocator().getName().toUri();
       os << std::endl;
 
-      if (printRaw && re.getContentType() == NDNS_BLOB) {
+      if (printRaw && (re.getContentType() == NDNS_BLOB
+                       || re.getContentType() == NDNS_KEY)) {
         util::IndentedStream istream(os, "; ");
 
         if (re.getRrType() == label::CERT_RR_TYPE) {
diff --git a/src/util/util.cpp b/src/util/util.cpp
index 31f3549..bbdf0c2 100644
--- a/src/util/util.cpp
+++ b/src/util/util.cpp
@@ -36,6 +36,8 @@
     return NDNS_BLOB;
   else if (str == "link")
     return NDNS_LINK;
+  else if (str == "key")
+    return NDNS_LINK;
   else
     return NDNS_UNKNOWN;
 }
diff --git a/tests/unit/clients/response.cpp b/tests/unit/clients/response.cpp
index 5c41f7d..88941c8 100644
--- a/tests/unit/clients/response.cpp
+++ b/tests/unit/clients/response.cpp
@@ -36,12 +36,12 @@
   ndns::Response r(zone, qType);
   r.setRrLabel(Name("/ndnsim/www"));
   r.setRrType(label::CERT_RR_TYPE);
-  r.setContentType(NDNS_BLOB);
+  r.setContentType(NDNS_KEY);
   r.setFreshnessPeriod(time::seconds(4000));
 
   BOOST_CHECK_EQUAL(r.getFreshnessPeriod(), time::seconds(4000));
   BOOST_CHECK_EQUAL(r.getRrType(), label::CERT_RR_TYPE);
-  BOOST_CHECK_EQUAL(r.getContentType(), NDNS_BLOB);
+  BOOST_CHECK_EQUAL(r.getContentType(), NDNS_KEY);
   BOOST_CHECK_EQUAL(r.getZone(), zone);
   BOOST_CHECK_EQUAL(r.getQueryType(), qType);
 
diff --git a/tests/unit/daemon/name-server.cpp b/tests/unit/daemon/name-server.cpp
index 4b6af12..581f3e0 100644
--- a/tests/unit/daemon/name-server.cpp
+++ b/tests/unit/daemon/name-server.cpp
@@ -85,8 +85,6 @@
   BOOST_CHECK_EQUAL(hasDataBack, true);
 }
 
-BOOST_AUTO_TEST_CASE_EXPECTED_FAILURES(KeyQuery, 2)
-
 BOOST_AUTO_TEST_CASE(KeyQuery)
 {
   Query q(zone, ndns::label::NDNS_ITERATIVE_QUERY);
@@ -109,7 +107,7 @@
   face.receive(q.toInterest());
   run();
 
-  // will ask for the existing record (will have type NDNS_BLOB, as it is certificate)
+  // will ask for the existing record (will have type NDNS_KEY, as it is certificate)
   face.onSendData.connectSingleShot([&] (const Data& data) {
     ++nDataBack;
     NDNS_LOG_TRACE("get Data back");
@@ -117,7 +115,7 @@
 
     Response resp;
     BOOST_CHECK_NO_THROW(resp.fromData(zone, data));
-    BOOST_CHECK_EQUAL(resp.getContentType(), NDNS_BLOB);
+    BOOST_CHECK_EQUAL(resp.getContentType(), NDNS_KEY);
   });
 
   q.setRrLabel("dsk-1");
@@ -135,7 +133,7 @@
 
     Response resp;
     BOOST_CHECK_NO_THROW(resp.fromData(zone, data));
-    BOOST_CHECK_EQUAL(resp.getContentType(), NDNS_BLOB);
+    BOOST_CHECK_EQUAL(resp.getContentType(), NDNS_KEY);
   });
 
   run();
diff --git a/tests/unit/database-test-data.cpp b/tests/unit/database-test-data.cpp
index 4b1de42..c3f6e07 100644
--- a/tests/unit/database-test-data.cpp
+++ b/tests/unit/database-test-data.cpp
@@ -80,7 +80,7 @@
     name::Component qType(label::NDNS_ITERATIVE_QUERY);
     NdnsContentType contentType = NDNS_RESP;
     if (type == label::CERT_RR_TYPE) {
-      contentType = NDNS_BLOB;
+      contentType = NDNS_KEY;
       qType = label::NDNS_CERT_QUERY;
     } else if (type == label::NS_RR_TYPE) {
       contentType = NDNS_LINK;