diff --git a/authority/server/db.js b/authority/server/db.js
index 0e70d3a36ed0f539cb59a97976cdc2f1f30dbc52..b00414b18c3c03529bae92a48df6f4282e1ebb9d 100644
--- a/authority/server/db.js
+++ b/authority/server/db.js
@@ -118,6 +118,33 @@ exports.addEmailToAccount = function(existing_email, email, pubkey, cb) {
   });
 }
 
+exports.addKeyToEmail = function(existing_email, email, pubkey, cb) {
+  console.log("so you want to add a key ("+pubkey+") to " + email);
+  emailToUserID(existing_email, function(userID) {
+    if (userID == undefined) {
+      cb("no such email: " + existing_email, undefined);
+      return;
+    }
+
+    db.execute("SELECT emails.id FROM emails,users WHERE users.id = ? AND emails.address = ? AND emails.user = users.id",
+               [ userID, email ],
+               function(err, rows) {
+                 if (err || rows.length != 1) {
+                   cb(err);
+                   return;
+                 }
+                 executeTransaction([
+                   [ "INSERT INTO keys (email, key, expires) VALUES(?,?,?)",
+                     [ rows[0].id, pubkey, ((new Date()).getTime() + (14 * 24 * 60 * 60 * 1000)) ]
+                   ]
+                 ], function (error) {
+                   if (error) cb(error);
+                   else cb();
+                 });
+               });
+  });
+}
+
 /* takes an argument object including email, pass, and pubkey. */
 exports.stageUser = function(obj) {
   var secret = generateSecret();
diff --git a/authority/server/wsapi.js b/authority/server/wsapi.js
index 9b8e22dc0a259a9ddde0dc943a60e22505b95e58..1dc316de155b6049e64d15df1618db98f18ed75d 100644
--- a/authority/server/wsapi.js
+++ b/authority/server/wsapi.js
@@ -134,7 +134,7 @@ exports.set_key = function (req, resp) {
   if (!checkParams(getArgs, resp, [ "email", "pubkey" ])) return;
   if (!isAuthed(req, resp)) return;
   logRequest("set_key", getArgs);
-  db.addEmailToAccount(req.session.authenticatedUser, getArgs.email, getArgs.pubkey, function (rv) {
+  db.addKeyToEmail(req.session.authenticatedUser, getArgs.email, getArgs.pubkey, function (rv) {
     httputils.jsonResponse(resp, rv);
   });
 };