diff --git a/.eslintrc.js b/.eslintrc.js
index 51bb141..39bbd90 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -26,7 +26,19 @@ module.exports = {
     '@xpring-eng/eslint-config-base',
   ],
 
-  rules: {},
+  rules: {
+    // linter doesn't seem to understand ESM imports used by jose, even though typescript handles them just fine.
+    "node/no-missing-import": ["error", {
+      allowModules: ["jose"],
+    }],
+    "import/no-unresolved": [
+      2,
+      {
+        ignore: [
+          'jose'
+        ]
+      }],
+  },
   overrides: [
     {
       "files": ["*cli.ts"],
diff --git a/package-lock.json b/package-lock.json
index fdb91d3..c776660 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "@paystring/paystring-cli",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -414,18 +414,12 @@
         }
       }
     },
-    "@panva/asn1.js": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@panva/asn1.js/-/asn1.js-1.0.0.tgz",
-      "integrity": "sha512-UdkG3mLEqXgnlKsWanWcgb6dOjUzJ+XC5f+aWw30qrtjxeNUSfKX1cd5FBzOaXQumoe9nIqeZUvrRJS03HCCtw=="
-    },
     "@paystring/utils": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@paystring/utils/-/utils-1.3.0.tgz",
-      "integrity": "sha512-2tFuSrwCVsJkdDzU+JjcEdlmcOxR6lo/Hj+lCNDGqxctlCiSl9J5oMyAPiSNIxQ5R3CdJhC/QdRu4f320CC0iw==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@paystring/utils/-/utils-2.0.0.tgz",
+      "integrity": "sha512-c2j6Jl0cge/snlMLDGLGBDgVWD+p8wE/8bdOBfo++9q/421zZe9D4WujrlD/y7D2S2bqZN6pmRpcJ3LZR/iI3A==",
       "requires": {
-        "axios": "^0.19.2",
-        "jose": "^1.27.3"
+        "jose": "^3.4.0"
       }
     },
     "@types/chai": {
@@ -749,6 +743,17 @@
         "is-string": "^1.0.4"
       }
     },
+    "asn1.js": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/asn1.js/-/asn1.js-5.4.1.tgz",
+      "integrity": "sha512-+I//4cYPccV8LdmBLiX8CYvf9Sp3vQsrqu2QNXRcrbiWvcx/UdlFiqUJJzxRQxgsZmvhXhn4cSKeSmoFjVdupA==",
+      "requires": {
+        "bn.js": "^4.0.0",
+        "inherits": "^2.0.1",
+        "minimalistic-assert": "^1.0.0",
+        "safer-buffer": "^2.1.0"
+      }
+    },
     "assertion-error": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-1.1.0.tgz",
@@ -815,6 +820,11 @@
       "integrity": "sha512-1Yj8h9Q+QDF5FzhMs/c9+6UntbD5MkRfRwac8DoEm9ZfUBZ7tZ55YcGVAzEe4bXsdQHEk+s9S5wsOKVdZrw0tQ==",
       "dev": true
     },
+    "bn.js": {
+      "version": "4.11.9",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.11.9.tgz",
+      "integrity": "sha512-E6QoYqCKZfgatHTdHzs1RRKP7ip4vvm+EyRUeE2RF0NblwVvb0p6jSVeNTOFxPn26QXN2o6SMfNxKp6kU8zQaw=="
+    },
     "brace-expansion": {
       "version": "1.1.11",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
@@ -1148,6 +1158,14 @@
       "integrity": "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg==",
       "dev": true
     },
+    "ec-key": {
+      "version": "0.0.4",
+      "resolved": "https://registry.npmjs.org/ec-key/-/ec-key-0.0.4.tgz",
+      "integrity": "sha512-jJkzm7XWb4Bcu4TpuQnOZD/OGSW3Y35S0Qe0cpnJsricaJtC+Tl3I0OKwgQasxNiEFt0Czv89ncq7vrHSgMj/w==",
+      "requires": {
+        "asn1.js": "^5.2.0"
+      }
+    },
     "emoji-regex": {
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-7.0.3.tgz",
@@ -2084,8 +2102,7 @@
     "inherits": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
     },
     "inquirer": {
       "version": "0.11.0",
@@ -2431,12 +2448,9 @@
       "dev": true
     },
     "jose": {
-      "version": "1.28.0",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-1.28.0.tgz",
-      "integrity": "sha512-JmfDRzt/HSj8ipd9TsDtEHoLUnLYavG+7e8F6s1mx2jfVSfXOTaFQsJUydbjJpTnTDHP1+yKL9Ke7ktS/a0Eiw==",
-      "requires": {
-        "@panva/asn1.js": "^1.0.0"
-      }
+      "version": "3.5.0",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-3.5.0.tgz",
+      "integrity": "sha512-pW9z+ny33gxX2wXLQl3SkPQWGaUvOMYLijuiMHIHUYIDsrZjdMqYYS5UTkusuMzZkqe5T8YImA4FOqqB1IWmRg=="
     },
     "js-tokens": {
       "version": "4.0.0",
@@ -2572,6 +2586,11 @@
       "integrity": "sha1-5WqpTEyAVaFkBKBnS3jyFffI4ZQ=",
       "dev": true
     },
+    "minimalistic-assert": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
+      "integrity": "sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A=="
+    },
     "minimatch": {
       "version": "3.0.4",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
@@ -2747,11 +2766,6 @@
       "integrity": "sha1-esGavSl+Caf3KnFUXZUbUX5N3iw=",
       "dev": true
     },
-    "node-forge": {
-      "version": "0.10.0",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz",
-      "integrity": "sha512-PPmu8eEeG9saEUvI97fm4OYxXVB6bFvyNTyiUOBichBpFG8A1Ljw3bY62+5oOjDEMHRnd0Y7HQ+x7uzxOzC6JA=="
-    },
     "node-localstorage": {
       "version": "0.6.0",
       "resolved": "https://registry.npmjs.org/node-localstorage/-/node-localstorage-0.6.0.tgz",
@@ -3421,6 +3435,11 @@
       "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
       "dev": true
     },
+    "safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
+    },
     "semver": {
       "version": "7.3.2",
       "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.2.tgz",
diff --git a/package.json b/package.json
index 9a9d6d5..1bfa3e1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@paystring/paystring-cli",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "description": "CLI for PayString",
   "homepage": "https://github.com/paystring/paystring-cli#readme",
   "bugs": {
@@ -28,11 +28,11 @@
     "test": "nyc mocha 'test/**/*.test.ts'"
   },
   "dependencies": {
-    "@paystring/utils": "^1.3.0",
+    "@paystring/utils": "^2.0.0",
     "axios": "^0.19.2",
     "beautify-json": "^1.0.1",
-    "jose": "^1.27.3",
-    "node-forge": "^0.10.0",
+    "ec-key": "0.0.4",
+    "jose": "^3.5.0",
     "vorpal": "^1.12.0"
   },
   "devDependencies": {
diff --git a/src/commands/key-generate.ts b/src/commands/key-generate.ts
index d22c493..3b79e87 100644
--- a/src/commands/key-generate.ts
+++ b/src/commands/key-generate.ts
@@ -1,7 +1,8 @@
-import { JWK } from 'jose'
+import { generateNewKey } from '@paystring/utils'
 
 import Command from './Command'
 import { writeFile } from './files'
+import { jwkToPem } from './pem-utils'
 
 /**
  * Generates an identity key, loads the key into local storage and saves the key
@@ -12,8 +13,8 @@ export default class GenerateIdentityKeyCommand extends Command {
    * @override
    */
   protected async action(): Promise<void> {
-    const key = await JWK.generate('EC', 'P-256')
-    const pem = key.toPEM(true)
+    const key = await generateNewKey()
+    const pem = jwkToPem(key)
     try {
       const filename = await writeFile('./identity-key.pem', pem)
       this.vorpal.log(`wrote key to ${filename}`)
@@ -21,7 +22,7 @@ export default class GenerateIdentityKeyCommand extends Command {
       this.vorpal.log('failed to write key, outputting instead')
       this.vorpal.log(pem)
     }
-    this.localStorage.addSigningKey('identity-keys', key.toJWK(true))
+    this.localStorage.addSigningKey('identity-keys', key)
   }
 
   /**
diff --git a/src/commands/key-load.ts b/src/commands/key-load.ts
index 4b6ed76..f57432c 100644
--- a/src/commands/key-load.ts
+++ b/src/commands/key-load.ts
@@ -1,7 +1,7 @@
-import { getSigningKeyFromFile } from '@paystring/utils'
 import * as Vorpal from 'vorpal'
 
 import Command from './Command'
+import { getSigningKeyFromFile } from './pem-utils'
 
 /**
  * Loads an identity key from a PEM file.
@@ -17,7 +17,7 @@ export default class LoadIdentityKeyCommand extends Command {
     this.vorpal.log(`loading identity-key from ${filePath}`)
     const key = await getSigningKeyFromFile(filePath)
     this.vorpal.log(`loaded identity-key from ${filePath}. Sign away.`)
-    this.localStorage.addSigningKey('identity-keys', key.toJWK(true))
+    this.localStorage.addSigningKey('identity-keys', key)
   }
 
   /**
diff --git a/src/commands/keys-list.ts b/src/commands/keys-list.ts
index 264ac08..2012be7 100644
--- a/src/commands/keys-list.ts
+++ b/src/commands/keys-list.ts
@@ -35,10 +35,11 @@ export default class ListKeysCommand extends Command {
     const keys = this.localStorage.getSigningKeys(name)
     keys.forEach((key) => {
       const kid = key.kid ?? 'not set'
-      if ('crv' in key) {
-        this.vorpal.log(`${name}: type=${key.kty}, type=${key.crv}, id=${kid}`)
+      const kty = key.kty ?? 'not set'
+      if (typeof key.crv === 'string') {
+        this.vorpal.log(`${name}: type=${kty}, type=${key.crv}, id=${kid}`)
       } else {
-        this.vorpal.log(`${name}: type=${key.kty}, id=${kid}`)
+        this.vorpal.log(`${name}: type=${kty}, id=${kid}`)
       }
     })
   }
diff --git a/src/commands/keys-print.ts b/src/commands/keys-print.ts
index 4bac556..5bbfd54 100644
--- a/src/commands/keys-print.ts
+++ b/src/commands/keys-print.ts
@@ -1,6 +1,5 @@
-import { toKey } from '@paystring/utils'
-
 import Command from './Command'
+import { jwkToPem } from './pem-utils'
 
 /**
  * Prints, to console, a summary of the identity and server keys that are currently loaded in
@@ -36,7 +35,7 @@ export default class PrintKeysCommand extends Command {
   private printKeys(name: string): void {
     const keys = this.localStorage.getSigningKeys(name)
     keys.forEach((key) => {
-      const pem = toKey(key).toPEM(true)
+      const pem = jwkToPem(key)
       this.vorpal.log(pem)
     })
   }
diff --git a/src/commands/localstorage.ts b/src/commands/localstorage.ts
index f5c230e..fd6b11f 100644
--- a/src/commands/localstorage.ts
+++ b/src/commands/localstorage.ts
@@ -1,5 +1,5 @@
 import { PaymentInformation } from '@paystring/utils'
-import { JWKECKey, JWKOctKey, JWKOKPKey, JWKRSAKey } from 'jose'
+import { JWK } from 'jose/webcrypto/types'
 import * as Vorpal from 'vorpal'
 
 /**
@@ -53,12 +53,10 @@ export default class LocalStorage {
    * @param name - The name of the key.
    * @returns The key or null.
    */
-  public getSigningKeys(
-    name: string,
-  ): Array<JWKRSAKey | JWKECKey | JWKOKPKey | JWKOctKey> {
+  public getSigningKeys(name: string): JWK[] {
     const existing = this.getItem(name)
     if (existing) {
-      return existing as Array<JWKRSAKey | JWKECKey | JWKOKPKey | JWKOctKey>
+      return existing as JWK[]
     }
     return []
   }
@@ -70,10 +68,7 @@ export default class LocalStorage {
    * @param name - The name of the key.
    * @param key - The key to store.
    */
-  public addSigningKey(
-    name: string,
-    key: JWKRSAKey | JWKECKey | JWKOKPKey | JWKOctKey,
-  ): void {
+  public addSigningKey(name: string, key: JWK): void {
     const keys = this.getSigningKeys(name)
     const updated = keys.concat(key)
     this.setItem(name, JSON.stringify(updated))
@@ -94,12 +89,7 @@ export default class LocalStorage {
    * @param name - The name of the item to get.
    * @returns The object or undefined if not in localstore.
    */
-  private getItem(
-    name: string,
-  ):
-    | Array<JWKRSAKey | JWKECKey | JWKOKPKey | JWKOctKey>
-    | PaymentInformation
-    | undefined {
+  private getItem(name: string): JWK[] | PaymentInformation | undefined {
     const rawValue = this.localStorage.getItem(name)
     if (rawValue && typeof rawValue === 'string') {
       try {
diff --git a/src/commands/paystring-inspect.ts b/src/commands/paystring-inspect.ts
index ffef816..470213d 100644
--- a/src/commands/paystring-inspect.ts
+++ b/src/commands/paystring-inspect.ts
@@ -44,7 +44,7 @@ export default class InspectPayStringCommand extends Command {
    */
   protected async action(args: Vorpal.Args): Promise<void> {
     const info = await this.payStringFromArgsOrLocalStorage(args)
-    const result = this.paymentInformationInspector.inspect(info)
+    const result = await this.paymentInformationInspector.inspect(info)
     this.vorpal.log(`${info.payId} ${validString(result.isVerified)}`)
     result.verifiedAddressesResults.forEach((addressResult) => {
       const address = addressResult.address
@@ -83,9 +83,10 @@ export default class InspectPayStringCommand extends Command {
       )}`,
     )
     if (signatureResult.jwk && signatureResult.keyType) {
-      const thumbprint = signatureResult.jwk.thumbprint
+      const thumbprint = signatureResult.jwk.kid ?? 'not set'
+      const kty = signatureResult.jwk.kty ?? 'no key type'
       this.vorpal.log(
-        `  - Signed with ${signatureResult.jwk.kty} ${signatureResult.keyType} with thumbprint ${thumbprint}`,
+        `  - Signed with ${kty} ${signatureResult.keyType} with thumbprint ${thumbprint}`,
       )
     }
   }
diff --git a/src/commands/paystring-sign.ts b/src/commands/paystring-sign.ts
index a4d4d2d..d829b68 100644
--- a/src/commands/paystring-sign.ts
+++ b/src/commands/paystring-sign.ts
@@ -1,11 +1,9 @@
 import {
-  convertToVerifiedAddress,
+  getDefaultAlgorithm,
   IdentityKeySigningParams,
   PaymentInformation,
   signWithKeys,
-  toKey,
 } from '@paystring/utils'
-import { JWKECKey, JWKOctKey, JWKOKPKey, JWKRSAKey } from 'jose'
 import * as Vorpal from 'vorpal'
 
 import Command from './Command'
@@ -47,7 +45,7 @@ export default class SignPayStringCommand extends Command {
       return
     }
 
-    const updated = signPayString(info, signingKeys, isKeepAddresses)
+    const updated = await signPayString(info, signingKeys, isKeepAddresses)
 
     this.localStorage.setPaymentInfo(updated)
     this.logPaymentInfo(updated)
@@ -75,8 +73,7 @@ export default class SignPayStringCommand extends Command {
   private getSigningKey(): IdentityKeySigningParams[] {
     const identityKeys = this.localStorage.getSigningKeys('identity-keys')
     return identityKeys.map(
-      (key) =>
-        new IdentityKeySigningParams(toKey(key), getDefaultAlgorithm(key)),
+      (key) => new IdentityKeySigningParams(key, getDefaultAlgorithm(key)),
     )
   }
 }
@@ -90,16 +87,17 @@ export default class SignPayStringCommand extends Command {
  * @param isKeepAddresses - If true, the unverified addresses property will be retained instead of cleared.
  * @returns A copy of the PaymentInformation but with verified addresses.
  */
-export function signPayString(
+export async function signPayString(
   info: PaymentInformation,
   signingKeys: IdentityKeySigningParams[],
   isKeepAddresses: boolean,
-): PaymentInformation {
+): Promise<PaymentInformation> {
   const payId = info.payId
-  const updatedAddresses = info.addresses.map((address) => {
-    const jws = signWithKeys(payId, address, signingKeys)
-    return convertToVerifiedAddress(jws)
-  })
+  const updatedAddresses = await Promise.all(
+    info.addresses.map(async (address) =>
+      signWithKeys(payId, address, signingKeys),
+    ),
+  )
   const updated = {
     payId: info.payId,
     addresses: isKeepAddresses ? info.addresses : [],
@@ -107,24 +105,3 @@ export function signPayString(
   }
   return updated
 }
-
-/**
- * Returns the default algorithm to use to sign with the given jwk.
- *
- * @param jwk - The key being used to sign.
- * @returns The default algorithm.
- */
-export function getDefaultAlgorithm(
-  jwk: JWKRSAKey | JWKECKey | JWKOctKey | JWKOKPKey,
-): string {
-  if (jwk.kty === 'EC') {
-    return 'ES256'
-  }
-  if (jwk.kty === 'oct') {
-    return 'HS512'
-  }
-  if (jwk.kty === 'OKP') {
-    return 'EdDSA'
-  }
-  return 'RS512'
-}
diff --git a/src/commands/paystring-verify.ts b/src/commands/paystring-verify.ts
index 4035ea2..6b3404e 100644
--- a/src/commands/paystring-verify.ts
+++ b/src/commands/paystring-verify.ts
@@ -16,7 +16,7 @@ export default class VerifyPayStringCommand extends Command {
    */
   protected async action(args: Vorpal.Args): Promise<void> {
     const info = await this.payStringFromArgsOrLocalStorage(args)
-    if (verifyPayString(info)) {
+    if (await verifyPayString(info)) {
       const addresses = info.verifiedAddresses.map((address) => {
         return convertJsonToAddress(address.payload)
       })
diff --git a/src/commands/pem-utils.ts b/src/commands/pem-utils.ts
new file mode 100644
index 0000000..e9ba012
--- /dev/null
+++ b/src/commands/pem-utils.ts
@@ -0,0 +1,48 @@
+import { promises } from 'fs'
+
+/* eslint-disable eslint-comments/no-unlimited-disable -- too many rules to disable */
+/* eslint-disable -- the linter hates ec-key import because it has no typedefs */
+const ECKey = require('ec-key')
+import { JWK } from 'jose/webcrypto/types'
+import calculateThumbprint from 'jose/jwk/thumbprint'
+import { getDefaultAlgorithm } from '@paystring/utils'
+
+/**
+ * Reads JWK key from a file.
+ *
+ * @param path - The full file path of the key file.
+ * @returns A JWK key.
+ */
+export async function getSigningKeyFromFile(path: string): Promise<JWK> {
+  const pem = await promises.readFile(path, 'ascii')
+  return pemToJwk(pem)
+}
+
+async function pemToJwk(pem: string): Promise<JWK> {
+  try {
+    const privateKey = new ECKey(pem, 'pem')
+    const jwk = {
+      kty: 'EC',
+      d: privateKey.d.toString('base64'),
+      x: privateKey.x.toString('base64'),
+      y: privateKey.y.toString('base64'),
+      crv: privateKey.jsonCurve,
+    }
+    const thumbprint = await calculateThumbprint(jwk)
+    return { ...jwk, kid: thumbprint, alg: getDefaultAlgorithm(jwk) }
+  } catch (e) {
+    throw new Error("could not read pem: " + e.message)
+  }
+}
+
+/**
+ * Converts a JWK to a PEM file string (including the header and footer sections).
+ *
+ * @param jwk - The JWK to convert.
+ * @return A PEM string.
+ */
+export function jwkToPem(jwk: JWK): string {
+  return new ECKey(jwk).toString('pem')
+}
+
+/* eslint-enable */
diff --git a/test/unit/getDefaultAlgorithm.test.ts b/test/unit/getDefaultAlgorithm.test.ts
deleted file mode 100644
index c78d12c..0000000
--- a/test/unit/getDefaultAlgorithm.test.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import 'mocha'
-import { assert } from 'chai'
-import { JWK } from 'jose'
-
-import { getDefaultAlgorithm } from '../../src/commands/paystring-sign'
-
-describe('when getDefaultAlgorithm()', function (): void {
-  it('given an EC key then returns ES256', async function (): Promise<void> {
-    const key = await JWK.generate('EC')
-    const algorithm = getDefaultAlgorithm(key.toJWK())
-    assert.equal(algorithm, 'ES256')
-  })
-
-  it('given an RSA key then returns RS512', async function (): Promise<void> {
-    const key = await JWK.generate('RSA')
-    const algorithm = getDefaultAlgorithm(key.toJWK())
-    assert.equal(algorithm, 'RS512')
-  })
-})
diff --git a/test/unit/getSigningKeyFromFile.test.ts b/test/unit/getSigningKeyFromFile.test.ts
new file mode 100644
index 0000000..36fb650
--- /dev/null
+++ b/test/unit/getSigningKeyFromFile.test.ts
@@ -0,0 +1,13 @@
+import 'mocha'
+import { assert } from 'chai'
+
+import { getSigningKeyFromFile } from '../../src/commands/pem-utils'
+
+import TEST_JWK from './jwkToPem.test'
+
+describe('when getSigningKeyFromFile()', function (): void {
+  it('given pem file containing EC private returns ES256 jwk', async function () {
+    const jwk = await getSigningKeyFromFile('test/unit/identity-key.pem')
+    assert.deepEqual(jwk, TEST_JWK)
+  })
+})
diff --git a/test/unit/identity-key.pem b/test/unit/identity-key.pem
new file mode 100644
index 0000000..bffe8f1
--- /dev/null
+++ b/test/unit/identity-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgywzMHwumNjJl44zd
+Mr9/J8hOvaLzS3maty54GQBmWoyhRANCAASrJWapK6/OMmWc1FE3KnOBDAWWtS4b
+YMXBh7Cj1aFlhPp6hXMZROZ1+S/EfLguSvanESlYj49SSbqTS88v5lkg
+-----END PRIVATE KEY-----
diff --git a/test/unit/jwkToPem.test.ts b/test/unit/jwkToPem.test.ts
new file mode 100644
index 0000000..238d86c
--- /dev/null
+++ b/test/unit/jwkToPem.test.ts
@@ -0,0 +1,32 @@
+import 'mocha'
+import { promises } from 'fs'
+
+import { assert } from 'chai'
+
+import { jwkToPem } from '../../src/commands/pem-utils'
+
+const TEST_JWK = {
+  kid: '4QDE254qxnrSYgCm2uEUdXmIzLiQaAX2i_eq2fDF4I4',
+  kty: 'EC',
+  alg: 'ES256',
+  crv: 'P-256',
+  // eslint-disable-next-line id-length -- jwk property
+  d: 'ywzMHwumNjJl44zdMr9/J8hOvaLzS3maty54GQBmWow=',
+  // eslint-disable-next-line id-length -- jwk property
+  x: 'qyVmqSuvzjJlnNRRNypzgQwFlrUuG2DFwYewo9WhZYQ=',
+  // eslint-disable-next-line id-length -- jwk property
+  y: '+nqFcxlE5nX5L8R8uC5K9qcRKViPj1JJupNLzy/mWSA=',
+}
+
+describe('when jwkToPem()', function (): void {
+  it('given jwk containing EC private returns expected pem', async function () {
+    const pem = jwkToPem(TEST_JWK)
+    const expectedPem = await promises.readFile(
+      'test/unit/identity-key.pem',
+      'ascii',
+    )
+    assert.equal(pem, expectedPem)
+  })
+})
+
+export default TEST_JWK
diff --git a/test/unit/signPayString.test.ts b/test/unit/signPayString.test.ts
index f89fc6d..d4e5bb9 100644
--- a/test/unit/signPayString.test.ts
+++ b/test/unit/signPayString.test.ts
@@ -1,11 +1,11 @@
 import 'mocha'
 import {
   AddressDetailsType,
+  generateNewKey,
   IdentityKeySigningParams,
   PaymentInformation,
 } from '@paystring/utils'
 import { assert } from 'chai'
-import { JWK } from 'jose'
 
 import { signPayString } from '../../src/commands/paystring-sign'
 
@@ -28,14 +28,14 @@ describe('when signPayString()', function (): void {
   let signingKey: IdentityKeySigningParams
 
   beforeEach('create key', async function (): Promise<void> {
-    const key = await JWK.generate('EC', 'P-256')
+    const key = await generateNewKey()
     signingKey = new IdentityKeySigningParams(key, 'ES256')
   })
 
   it('called with keepAddresses=true, then addresses property is retained', async function (): Promise<
     void
   > {
-    const result = signPayString(info, [signingKey], true)
+    const result = await signPayString(info, [signingKey], true)
     assert.equal(result.addresses, info.addresses)
     assert.lengthOf(result.verifiedAddresses, 1)
   })
@@ -43,7 +43,7 @@ describe('when signPayString()', function (): void {
   it('called with keepAddresses=false, then addresses property is cleared', async function (): Promise<
     void
   > {
-    const result = signPayString(info, [signingKey], false)
+    const result = await signPayString(info, [signingKey], false)
     assert.isEmpty(result.addresses)
     assert.lengthOf(result.verifiedAddresses, 1)
   })