diff --git a/blscurve.nim b/blscurve.nim
index bb2962c..a9a46de 100644
--- a/blscurve.nim
+++ b/blscurve.nim
@@ -12,7 +12,7 @@ import
   ./blscurve/eth2_keygen
 export
   SecretKey, PublicKey, Signature, ProofOfPossession,
-  `==`,
+  `==`, SecretByte,
   aggregate,
   sign, verify, aggregateVerify, fastAggregateVerify,
   keyGen, privToPub,
diff --git a/blscurve/bls_sig_io.nim b/blscurve/bls_sig_io.nim
index ec27b50..a74acdb 100644
--- a/blscurve/bls_sig_io.nim
+++ b/blscurve/bls_sig_io.nim
@@ -14,6 +14,7 @@
 
 # This file should be included to have access to private fields
 # It is kept separated as it does not fall under the IETF BLS specification
+export SecretByte
 
 func fromHex*[T: SecretKey|PublicKey|Signature|ProofOfPossession](
        obj: var T,
@@ -39,16 +40,16 @@ func fromBytes*[T: SecretKey|PublicKey|Signature|ProofOfPossession](
   else:
     result = obj.point.fromBytes(raw)
 
-func toHex*(obj: SecretKey|PublicKey|Signature|ProofOfPossession): string {.inline.} =
+func toHex*(pbj: SecretKey): distinct string {.error: "Returning the hex representation of a secret key is forbidden.".}
+  ## Prevent returning the hex representation of a SecretKey
+
+func toHex*(obj: PublicKey|Signature|ProofOfPossession): string {.inline.} =
   ## Return the hex representation of a BLS signature scheme object
   ## Signature and Proof-of-posessions are serialized in compressed form
-  when obj is SecretKey:
-    result = obj.intVal.toHex()
-  else:
-    result = obj.point.toHex()
+  result = obj.point.toHex()
 
 func serialize*(
-       dst: var openarray[byte],
+       dst: var openarray[byte or SecretByte],
        obj: SecretKey|PublicKey|Signature|ProofOfPossession): bool {.inline.} =
   ## Serialize the input `obj` in raw binary form and write it
   ## in `dst`.
@@ -63,7 +64,7 @@ const
   RawPublicKeySize = MODBYTES_384
   RawSignatureSize = MODBYTES_384 * 2
 
-func exportRaw*(secretKey: SecretKey): array[RawSecretKeySize, byte] {.inline.}=
+func exportRaw*(secretKey: SecretKey): array[RawSecretKeySize, SecretByte] {.inline.}=
   ## Serialize a secret key into its raw binary representation
   # TODO: the SecretKey size is actually not 384 bit
   #       but 255 bit since the curve order requires 255-bit
diff --git a/blscurve/common.nim b/blscurve/common.nim
index 429e0ac..030b336 100644
--- a/blscurve/common.nim
+++ b/blscurve/common.nim
@@ -32,6 +32,8 @@ const
 
 type
   Domain* = array[8, byte]
+  SecretHex* = distinct string
+  SecretByte* = distinct byte
 
 when sizeof(int) == 4 or defined(use32):
   const
@@ -549,19 +551,20 @@ proc isOnCurve*(x: FP2_BLS12381, y: FP2_BLS12381): bool =
   else:
     result = (sqr(y) == rhs(x))
 
-proc toBytes*(a: BIG_384, res: var openarray[byte]): bool =
+proc toBytes*(a: BIG_384, res: var openarray[byte or SecretByte]): bool =
   ## Serialize big integer ``a`` to ``res``. Length of ``res`` array
   ## must be at least ``MODBYTES_384``.
   ##
   ## Returns ``true`` if ``a`` was succesfully serialized,
   ## ``false`` otherwise.
+  type B = typeof(res[0]) # byte or SecretByte
   if len(res) >= MODBYTES_384:
     var c: BIG_384
     BIG_384_copy(c, a)
     # BIG_384_norm() function in Milagro operates inplace.
     discard BIG_384_norm(c)
     for i in countdown(MODBYTES_384 - 1, 0):
-      res[i] = byte(c[0] and 0xFF)
+      res[i] = B(c[0] and 0xFF)
       discard BIG_384_fshr(c, 8)
     result = true