diff --git a/monobean/Cargo.toml b/monobean/Cargo.toml
index 59f156a7..52c6636c 100644
--- a/monobean/Cargo.toml
+++ b/monobean/Cargo.toml
@@ -21,6 +21,7 @@ mono = { path = "../mono" }
 common = { path = "../common" }
 jupiter = { path = "../jupiter" }
 taurus = { path = "../taurus" }
+vault = { path = "../vault" }
 tokio = "1.43.0"
 russh = "0.50.2"
 axum = "0.8.1"
@@ -28,13 +29,19 @@ axum-server = "0.7.1"
 bytes = "1.10.0"
 
 async-channel = "2.3.1"
-thiserror = { version = "2.0.11", features = ["default"]}
+thiserror = { version = "2.0.11", features = ["default"] }
 tracing = "0.1.41"
-tracing-subscriber = { version = "0.3.19", features = ["default", "env-filter"]}
+tracing-subscriber = { version = "0.3.19", features = ["default", "env-filter"] }
 rustls = "0.23.23"
 gix-config = "0.43.0"
 home = "0.5.11"
-regex = "1.11.1" # there's a bug in glib, so use this alternatively
 
 [build-dependencies]
 glib-build-tools = "0.20.0"
+
+[profile.dev]
+panic = "abort" # glib panics are not human friendly, just leave them alone
+
+[profile.release]
+lto = "fat"
+
diff --git a/monobean/resources/css/common.css b/monobean/resources/css/common.css
index a58c4be5..27100c77 100644
--- a/monobean/resources/css/common.css
+++ b/monobean/resources/css/common.css
@@ -1,3 +1,3 @@
 .right-side-box {
     background-color: @view_bg_color;
-}
+}
\ No newline at end of file
diff --git a/monobean/resources/gtk/hello_page.ui b/monobean/resources/gtk/hello_page.ui
index 88f07ff1..9b50d8e2 100644
--- a/monobean/resources/gtk/hello_page.ui
+++ b/monobean/resources/gtk/hello_page.ui
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <interface>
-  <requires lib="gtk" version="4.0" />
+  <requires lib="gtk" version="4.0"/>
   <template class="HelloPage" parent="GtkBox">
     <property name="orientation">vertical</property>
     <property name="hexpand">true</property>
@@ -93,41 +93,41 @@
         <child type="top">
           <!-- Title Bar -->
 
-            <object class="AdwHeaderBar" id="header_bar">
-              <property name="centering-policy">strict</property>
-              <child type="start">
-                <object class="GtkBox">
-                  <property name="orientation">horizontal</property>
-
-                  <!-- MenuBar -->
-                  <child>
-                    <object class="GtkPopoverMenuBar" id="menubar1">
-                      <property name="menu-model">menubar</property>
-                      <accessibility>
-                        <property name="label">Main Menu</property>
-                      </accessibility>
-                    </object>
-                  </child>
-
-                  <child>
-                    <object class="GtkButton" id="back_button">
-                      <property name="visible">false</property>
-                      <property name="action-name">win.back-button</property>
-                      <property name="icon-name">go-previous-symbolic</property>
-                    </object>
-                  </child>
-                </object>
-              </child>
-              <child type="end">
-                <object class="GtkMenuButton" id="primary_menu_button">
-                  <property name="menu-model">primary_menu</property>
-                  <property name="icon-name">open-menu-symbolic</property>
-                </object>
-              </child>
-              <child type="title">
-                <object class="GtkLabel">Hello</object>
-              </child>
-            </object>
+          <object class="AdwHeaderBar" id="header_bar">
+            <property name="centering-policy">strict</property>
+            <child type="start">
+              <object class="GtkBox">
+                <property name="orientation">horizontal</property>
+
+                <!-- MenuBar -->
+                <child>
+                  <object class="GtkPopoverMenuBar" id="menubar1">
+                    <property name="menu-model">menubar</property>
+                    <accessibility>
+                      <property name="label">Main Menu</property>
+                    </accessibility>
+                  </object>
+                </child>
+
+                <child>
+                  <object class="GtkButton" id="back_button">
+                    <property name="visible">false</property>
+                    <property name="action-name">win.back-button</property>
+                    <property name="icon-name">go-previous-symbolic</property>
+                  </object>
+                </child>
+              </object>
+            </child>
+            <child type="end">
+              <object class="GtkMenuButton" id="primary_menu_button">
+                <property name="menu-model">primary_menu</property>
+                <property name="icon-name">open-menu-symbolic</property>
+              </object>
+            </child>
+            <child type="title">
+              <object class="GtkLabel">Hello</object>
+            </child>
+          </object>
 
         </child>
 
@@ -172,8 +172,8 @@
                             <property name="wrap-mode">word-char</property>
                             <property name="justify">center</property>
                             <style>
-                              <class name="title" />
-                              <class name="title-1" />
+                              <class name="title"/>
+                              <class name="title-1"/>
                             </style>
                           </object>
                         </child>
@@ -209,12 +209,26 @@
                           <object class="AdwPreferencesGroup">
 
                             <child>
-                              <object class="AdwActionRow">
-                                <property name="title" translatable="yes">GPG Key</property>
+                              <object class="AdwActionRow" id="pgp_row">
+                                <property name="title" translatable="yes">PGP Key</property>
                                 <child>
-                                  <object class="GtkButton">
-                                    <property name="label" translatable="yes">General</property>
-                                    <property name="valign">center</property>
+                                  <object class="GtkBox">
+                                    <property name="orientation">horizontal</property>
+                                    <property name="spacing">12</property>
+                                    <child>
+                                      <object class="AdwSpinner" id="pgp_spin">
+                                        <property name="halign">center</property>
+                                        <property name="valign">center</property>
+                                        <property name="visible">False</property>
+                                      </object>
+                                    </child>
+
+                                    <child>
+                                      <object class="GtkButton" id="pgp_button">
+                                        <property name="label" translatable="yes">Generate</property>
+                                        <property name="valign">center</property>
+                                      </object>
+                                    </child>
                                   </object>
                                 </child>
                               </object>
@@ -239,8 +253,8 @@
                                 <property name="tooltip-text" translatable="yes">Import repositories from local or an URL</property>
                                 <property name="focusable">True</property>
                                 <style>
-                                  <class name="card" />
-                                  <class name="activatable" />
+                                  <class name="card"/>
+                                  <class name="activatable"/>
                                 </style>
                                 <property name="child">
                                   <object class="GtkBox">
@@ -257,7 +271,7 @@
                                         <property name="icon-name">document-open-symbolic</property>
                                         <property name="pixel-size">24</property>
                                         <style>
-                                          <class name="lowres-icon" />
+                                          <class name="lowres-icon"/>
                                         </style>
                                       </object>
                                     </child>
@@ -279,8 +293,8 @@
                                 <property name="tooltip-text" translatable="yes">Network settings</property>
                                 <property name="focusable">True</property>
                                 <style>
-                                  <class name="card" />
-                                  <class name="activatable" />
+                                  <class name="card"/>
+                                  <class name="activatable"/>
                                 </style>
                                 <property name="child">
                                   <object class="GtkBox">
@@ -297,7 +311,7 @@
                                         <property name="icon-name">network-cellular-signal-excellent-symbolic-rtl</property>
                                         <property name="pixel-size">24</property>
                                         <style>
-                                          <class name="lowres-icon" />
+                                          <class name="lowres-icon"/>
                                         </style>
                                       </object>
                                     </child>
@@ -326,15 +340,15 @@
                             <property name="halign">center</property>
                             <property name="child">
 
-                                <object class="GtkButton" id="continue_button">
-                                  <property name="label" translatable="yes">Go Ahead!</property>
-                                  <property name="valign">center</property>
-                                  <property name="sensitive">False</property>
-                                  <style>
-                                    <class name="suggested-action" />
-                                    <class name="pill"/>
-                                  </style>
-                                </object>
+                              <object class="GtkButton" id="continue_button">
+                                <property name="label" translatable="yes">Go Ahead!</property>
+                                <property name="valign">center</property>
+                                <property name="sensitive">False</property>
+                                <style>
+                                  <class name="suggested-action"/>
+                                  <class name="pill"/>
+                                </style>
+                              </object>
 
                             </property>
                           </object>
@@ -366,8 +380,8 @@
                 </layout>
 
                 <style>
-                  <class name="card" />
-                  <class name="right-side-box" />
+                  <class name="card"/>
+                  <class name="right-side-box"/>
                 </style>
 
                 <child>
@@ -383,7 +397,7 @@
                         <property name="valign">end</property>
                         <property name="tooltip-text">icon-dropshadow</property>
                         <style>
-                          <class name="icon-dropshadow" />
+                          <class name="icon-dropshadow"/>
                         </style>
                       </object>
                     </property>
@@ -413,7 +427,7 @@
                                 <property name="orientation">vertical</property>
                                 <child>
                                   <object class="GtkLabel">
-                                    <property name="label" translatable="yes"> &lt;a href="https://os.gnome.org/">MonoBean Docs&lt;/a&gt;</property>
+                                    <property name="label" translatable="yes">&lt;a href="https://os.gnome.org/">MonoBean Docs&lt;/a&gt;</property>
                                     <property name="wrap">True</property>
                                     <property name="wrap-mode">word-char</property>
                                     <property name="use-markup">True</property>
@@ -422,7 +436,7 @@
                                 </child>
                                 <child>
                                   <object class="GtkLabel">
-                                    <property name="label" translatable="yes"> &lt;a href="https://os.gnome.org/">Watch Videos&lt;/a&gt;</property>
+                                    <property name="label" translatable="yes">&lt;a href="https://os.gnome.org/">Watch Videos&lt;/a&gt;</property>
                                     <property name="wrap">True</property>
                                     <property name="wrap-mode">word-char</property>
                                     <property name="use-markup">True</property>
@@ -449,8 +463,8 @@
                             <property name="opacity">0.8</property>
 
                             <style>
-                              <class name="title" />
-                              <class name="title-1" />
+                              <class name="title"/>
+                              <class name="title-1"/>
                             </style>
                           </object>
                         </property>
diff --git a/monobean/src/application.rs b/monobean/src/application.rs
index 27f00d9c..89bd7bd1 100644
--- a/monobean/src/application.rs
+++ b/monobean/src/application.rs
@@ -16,6 +16,7 @@ use gtk::{gio, glib};
 use std::cell::{OnceCell, RefCell};
 use std::fmt::Debug;
 use std::net::{IpAddr, SocketAddr};
+use tokio::sync::oneshot;
 use tracing_subscriber::fmt;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;
@@ -26,7 +27,7 @@ glib::wrapper! {
         @implements gio::ActionGroup, gio::ActionMap;
 }
 
-#[derive(Debug, Clone)]
+#[derive(Debug)]
 pub enum Action {
     // Mega Core Related Actions
     MegaCore(MegaCommands),
@@ -114,6 +115,7 @@ mod imp {
                     #[strong]
                     app,
                     async move {
+                        app.start_mega().await;
                         while let Ok(action) = receiver.recv().await {
                             app.process_action(action);
                         }
@@ -121,8 +123,6 @@ mod imp {
                 ),
             );
 
-            app.start_mega();
-
             // Ask the window manager/compositor to present the window
             window.present();
         }
@@ -167,7 +167,7 @@ impl MonobeanApplication {
             #[weak(rename_to = app)]
             self,
             move |_, _| {
-                app.send_command(MegaCommands::MegaShutdown);
+                app.blocking_send_command(MegaCommands::MegaShutdown);
                 app.quit();
             }
         ));
@@ -252,11 +252,15 @@ impl MonobeanApplication {
         dialog.present();
     }
 
-    pub fn send_command(&self, cmd: MegaCommands) {
-        self.imp().mega_delegate.send_command(cmd);
+    pub async fn send_command(&self, cmd: MegaCommands) {
+        self.imp().mega_delegate.send_command(cmd).await;
+    }
+
+    pub fn blocking_send_command(&self, cmd: MegaCommands) {
+        self.imp().mega_delegate.blocking_send_command(cmd);
     }
 
-    pub fn start_mega(&self) {
+    pub async fn start_mega(&self) {
         // The first Action of the application, so it can never block the gui thread.
         let http_addr = self
             .settings()
@@ -288,7 +292,20 @@ impl MonobeanApplication {
         self.send_command(MegaStart(
             Option::from(SocketAddr::new(http_addr, http_port as u16)),
             Option::from(SocketAddr::new(ssh_addr, ssh_port as u16)),
-        ));
+        ))
+        .await;
+    }
+
+    /// Send a command to mega core
+    ///
+    /// # Warning:
+    /// May stuck main event loop.
+    pub(crate) fn core_status(&self) -> oneshot::Receiver<(bool, bool)> {
+        let (tx, rx) = oneshot::channel();
+        let cmd = MegaCommands::CoreStatus(tx);
+        let act = Action::MegaCore(cmd);
+        self.sender().send_blocking(act).unwrap();
+        rx
     }
 
     fn process_action(&self, action: Action) {
@@ -296,12 +313,23 @@ impl MonobeanApplication {
             return;
         }
 
+        let window = self.imp().window.get().unwrap().upgrade().unwrap();
+
+        tracing::debug!("Processing Glib Action: {:?}", action);
         match action {
-            Action::MegaCore(cmd) => self.send_command(cmd),
+            Action::MegaCore(cmd) => {
+                let delegate = self.imp().mega_delegate;
+                CONTEXT.spawn(async move {
+                    tracing::debug!("Sending {:?}", cmd);
+                    delegate.send_command(cmd).await;
+                    tracing::debug!("Done");
+                });
+            }
             Action::AddToast(msg) => {
-                self.window().unwrap().add_toast(msg);
+                window.add_toast(msg);
             }
             Action::UpdateGitConfig(name, email) => {
+                let sender = self.sender();
                 let mut config = self.git_config();
                 config.set_raw_value(&"user.name", name.as_bytes()).unwrap();
                 config
@@ -316,24 +344,27 @@ impl MonobeanApplication {
                 tracing::debug!("Git config: {:?}", config.meta());
 
                 let toast = Action::AddToast("Git config updated!".to_string());
-                self.sender().send_blocking(toast).unwrap();
+                CONTEXT.spawn(async move {
+                    sender.send(toast).await.unwrap();
+                });
             }
 
             Action::ShowHelloPage => {
-                let window = self.imp().window.get().unwrap().upgrade().unwrap();
-
+                let config = self.git_config();
                 let stack = window.imp().base_stack.clone();
                 stack.set_visible_child_name("hello_page");
 
-                let config = self.git_config();
                 let name = config.string("user.name").map(|name| name.to_string());
                 let email = config.string("user.email").map(|email| email.to_string());
 
-                window.show_hello_page(name, email);
+                let rx = self.core_status();
+                CONTEXT.spawn_local(async move {
+                    let (_, gpg_generated) = rx.await.unwrap();
+                    window.show_hello_page(name, email, gpg_generated);
+                });
             }
 
             Action::ShowMainPage => {
-                let window = self.imp().window.get().unwrap().upgrade().unwrap();
                 window.show_main_page();
             }
         }
diff --git a/monobean/src/components/hello_page.rs b/monobean/src/components/hello_page.rs
index 4f0cbdc3..8f39c3ec 100644
--- a/monobean/src/components/hello_page.rs
+++ b/monobean/src/components/hello_page.rs
@@ -1,9 +1,13 @@
 use crate::application::Action;
-use adw::glib::{clone, GString};
+use crate::core::mega_core::MegaCommands;
+use crate::CONTEXT;
+use adw::glib::{clone, GString, Regex, RegexCompileFlags, RegexMatchFlags};
+use adw::prelude::*;
 use async_channel::Sender;
 use gtk::prelude::{ButtonExt, EditableExt, WidgetExt};
 use gtk::subclass::prelude::*;
 use gtk::{glib, CompositeTemplate};
+use tokio::sync::oneshot;
 
 mod imp {
     use super::*;
@@ -28,7 +32,12 @@ mod imp {
         pub email_entry: TemplateChild<adw::EntryRow>,
         #[template_child]
         pub continue_button: TemplateChild<gtk::Button>,
-
+        #[template_child]
+        pub pgp_row: TemplateChild<adw::PreferencesRow>,
+        #[template_child]
+        pub pgp_button: TemplateChild<gtk::Button>,
+        // #[template_child]
+        // pub pgp_spin: TemplateChild<adw::Spinner>,
         pub sender: OnceCell<Sender<Action>>,
     }
 
@@ -55,11 +64,9 @@ mod imp {
 
     impl WidgetImpl for HelloPage {}
     impl BoxImpl for HelloPage {}
-    
+
     #[gtk::template_callbacks]
-    impl HelloPage {
-        
-    }
+    impl HelloPage {}
 }
 
 glib::wrapper! {
@@ -86,24 +93,23 @@ impl HelloPage {
         let continue_button = self.imp().continue_button.clone();
         let email_entry = self.imp().email_entry.clone();
         let name_entry = self.imp().name_entry.clone();
-
-        let should_continue = move |name: GString, email: GString| -> bool {
-            // FIXME: There's a bug in glib regex, 
-            // we have to find a temporary solution for this.
-            
-            // let re = Regex::new(
-            //     r"^\w+(-+.\w+)*@\w+(-.\w+)*.\w+(-.\w+)*$",
-            //     RegexCompileFlags::DEFAULT,
-            //     RegexMatchFlags::DEFAULT,
-            // )
-            // .unwrap()
-            // .unwrap();
-            // 
-            // re.match_full(email.as_ref(),0 , RegexMatchFlags::DEFAULT)
-            //     .is_ok()
-            //     && !name.is_empty()
-            
-            !name.is_empty() && !email.is_empty()
+        let pgp_row = self.imp().pgp_row.clone();
+        let pgp_button = self.imp().pgp_button.clone();
+
+        let should_continue = move |name: GString, email: GString, btn_sensitive| -> bool {
+            let re = Regex::new(
+                r"^\w+(-+.\w+)*@\w+(-.\w+)*.\w+(-.\w+)*$",
+                RegexCompileFlags::DEFAULT,
+                RegexMatchFlags::DEFAULT,
+            )
+            .unwrap()
+            .unwrap();
+
+            if name.trim().is_empty() || email.trim().is_empty() || btn_sensitive {
+                return false;
+            }
+            re.match_full(email.as_gstr(), 0, RegexMatchFlags::DEFAULT)
+                .is_ok()
         };
 
         email_entry.connect_changed(clone!(
@@ -113,11 +119,17 @@ impl HelloPage {
             email_entry,
             #[weak]
             name_entry,
+            #[weak]
+            pgp_button,
             move |_| {
                 let email = email_entry.text();
                 let name = name_entry.text();
 
-                continue_button.set_sensitive(should_continue(name, email));
+                continue_button.set_sensitive(should_continue(
+                    name,
+                    email,
+                    pgp_button.is_sensitive(),
+                ));
             }
         ));
 
@@ -128,35 +140,111 @@ impl HelloPage {
             email_entry,
             #[weak]
             name_entry,
+            #[weak]
+            pgp_button,
             move |_| {
                 let email = email_entry.text();
                 let name = name_entry.text();
 
-                continue_button.set_sensitive(should_continue(name, email));
+                continue_button.set_sensitive(should_continue(
+                    name,
+                    email,
+                    pgp_button.is_sensitive(),
+                ));
+            }
+        ));
+
+        pgp_button.connect_clicked(clone!(
+            #[weak]
+            pgp_row,
+            #[weak]
+            pgp_button,
+            #[weak]
+            email_entry,
+            #[weak]
+            name_entry,
+            #[weak]
+            continue_button,
+            #[strong]
+            sender,
+            move |btn| {
+                // TODO: Ask user to input a passwd for pgp key.
+                let sender = sender.clone();
+                let (tx, rx) = oneshot::channel();
+                let pgp_command = Action::MegaCore(MegaCommands::LoadOrInitPgp(
+                    tx,
+                    name_entry.text().parse().unwrap(),
+                    email_entry.text().parse().unwrap(),
+                    None,
+                ));
+                btn.set_sensitive(false);
+
+                // Adw::Spinner type does not exist, we have to find a temporary solution for this.
+                let spinner = btn.prev_sibling();
+                #[cfg(debug_assertions)]
+                {
+                    assert!(spinner.is_some());
+                    assert_eq!(
+                        spinner.clone().unwrap().widget_name(),
+                        GString::from("AdwSpinner")
+                    );
+                }
+
+                let spinner = spinner.unwrap();
+                CONTEXT.spawn_local(async move {
+                    spinner.set_visible(true);
+                    sender.send(pgp_command).await.unwrap();
+                    if rx.await.is_err() {
+                        let toast = Action::AddToast("Failed to init pgp key".to_string());
+                        sender.send(toast).await.unwrap();
+                        pgp_button.set_sensitive(true);
+                    } else {
+                        let email = email_entry.text();
+                        let name = name_entry.text();
+                        pgp_row.set_title("PGP key already generated");
+                        continue_button.set_sensitive(should_continue(
+                            name,
+                            email,
+                            pgp_button.is_sensitive(),
+                        ));
+
+                        let toast = Action::AddToast("PGP key initialized".to_string());
+                        sender.send(toast).await.unwrap();
+                    }
+                    spinner.set_visible(false);
+                });
             }
         ));
-        
+
         continue_button.connect_clicked(clone!(
             #[weak]
             email_entry,
             #[weak]
             name_entry,
+            #[strong]
+            sender,
             move |_| {
                 let email = email_entry.text();
                 let name = name_entry.text();
-                sender.send_blocking(Action::UpdateGitConfig(name.to_string(), email.to_string())).unwrap();
+                sender
+                    .send_blocking(Action::UpdateGitConfig(name.to_string(), email.to_string()))
+                    .unwrap();
                 sender.send_blocking(Action::ShowMainPage).unwrap();
             }
         ));
     }
 
-    pub fn fill_entries(&self, name: Option<String>, email: Option<String>) {
+    pub fn fill_entries(&self, name: Option<String>, email: Option<String>, pgp_generated: bool) {
         if let Some(name) = name {
             self.imp().name_entry.set_text(&name);
         }
         if let Some(email) = email {
             self.imp().email_entry.set_text(&email);
         }
+        if pgp_generated {
+            self.imp().pgp_button.set_sensitive(false);
+            self.imp().pgp_row.set_title("PGP key already generated");
+        }
     }
 }
 
diff --git a/monobean/src/components/mod.rs b/monobean/src/components/mod.rs
index 5b5da2a7..30f973ac 100644
--- a/monobean/src/components/mod.rs
+++ b/monobean/src/components/mod.rs
@@ -1,7 +1,7 @@
 pub mod mega_tab;
-pub mod repo_tab;
 pub mod repo_detail;
+pub mod repo_tab;
 
-pub mod not_implemented;
 pub mod hello_page;
+pub mod not_implemented;
 pub mod theme_selector;
diff --git a/monobean/src/components/theme_selector.rs b/monobean/src/components/theme_selector.rs
index 744c60b8..0325a142 100644
--- a/monobean/src/components/theme_selector.rs
+++ b/monobean/src/components/theme_selector.rs
@@ -70,8 +70,7 @@ mod imp {
 fn load_css() {
     // Load the CSS file and add it to the provider
     let provider = CssProvider::new();
-    provider
-        .load_from_resource("/org/Web3Infrastructure/Monobean/css/themesselector.css");
+    provider.load_from_resource("/org/Web3Infrastructure/Monobean/css/themesselector.css");
 
     // Add the provider to the default screen
     style_context_add_provider_for_display(
diff --git a/monobean/src/config.rs b/monobean/src/config.rs
index 195572aa..ff5a331a 100644
--- a/monobean/src/config.rs
+++ b/monobean/src/config.rs
@@ -8,4 +8,4 @@ pub const APP_NAME: &str = "Monobean";
 pub const PREFIX: &str = "/org/Web3Infrastructure/Monobean";
 pub const MEGA_CONFIG_PATH: &str = "/org/Web3Infrastructure/Monobean/mega/config.toml";
 pub const MEGA_HTTPS_KEY: &str = "/org/Web3Infrastructure/Monobean/mega/key.pem";
-pub const MEGA_HTTPS_CERT: &str = "/org/Web3Infrastructure/Monobean/mega/cert.pem";
\ No newline at end of file
+pub const MEGA_HTTPS_CERT: &str = "/org/Web3Infrastructure/Monobean/mega/cert.pem";
diff --git a/monobean/src/core/delegate.rs b/monobean/src/core/delegate.rs
index 8eb2d3cb..baf6609c 100644
--- a/monobean/src/core/delegate.rs
+++ b/monobean/src/core/delegate.rs
@@ -1,54 +1,59 @@
 use crate::application::Action;
 use crate::core::mega_core::{MegaCommands, MegaCore};
 use crate::core::runtime;
-use async_channel::Sender;
-use std::sync::{Arc, OnceLock};
-use tokio::sync::Mutex;
+use async_channel::{Receiver, Sender};
+use std::sync::OnceLock;
 
 /// The delegate for the Mega core.
 /// If we directly use mega core in the application,
 /// it would be hard to operate cross glib and tokio runtimes.
 /// So we use this struct to build up a channel and delegate the commands to the mega core.
+#[derive(Clone, Debug)]
 pub struct MegaDelegate {
     inner: Sender<MegaCommands>,
-    core: Arc<Mutex<MegaCore>>,
 }
 
 impl MegaDelegate {
     pub fn new(action_sender: Sender<Action>) -> &'static Self {
         static DELEGATE: OnceLock<MegaDelegate> = OnceLock::new();
 
-        DELEGATE.get_or_init(move | |{
+        DELEGATE.get_or_init(move || {
             let (cmd_sender, cmd_receiver) = async_channel::unbounded();
-            let core = Arc::new(Mutex::new(MegaCore::new(action_sender, cmd_receiver)));
-            let ret = Self {
-                inner: cmd_sender,
-                core,
-            };
+            let ret = Self { inner: cmd_sender };
 
-            ret.init_core();
+            ret.init_core(action_sender, cmd_receiver);
             ret
         })
     }
 
-    pub fn init_core(&self) {
-        let core = self.core.clone();
+    fn init_core(&self, act_sender: Sender<Action>, cmd_receiver: Receiver<MegaCommands>) {
+        static CORE: OnceLock<MegaCore> = OnceLock::new();
+        let core = CORE.get_or_init(move || MegaCore::new(act_sender, cmd_receiver));
+
         std::thread::spawn(move || {
             runtime().block_on(async move {
-                if let Ok(mut lock) = core.try_lock() {
-                    tokio::select! {
-                        Ok(cmd) = lock.receiver.recv() => {
-                            lock.process_command(cmd).await;
-                        }
-                    }
-                } else {
-                    panic!("Failed to lock mega core.");
+                core.init().await;
+                while let Ok(cmd) = core.receiver.recv().await {
+                    tokio::spawn(async move {
+                        core.process_command(cmd).await;
+                    });
                 }
             });
         });
     }
 
-    pub fn send_command(&self, cmd: MegaCommands) {
+    /// Send a command to the mega core and block
+    pub async fn send_command(&self, cmd: MegaCommands) {
+        let _ = self.inner.send(cmd).await;
+    }
+
+    /// Send a command to the mega core and block until the command is sent.
+    ///
+    /// # Deadlock
+    ///
+    /// Same as described in `MegaCore::process_command` and async_channel::Sender::send_blocking.
+    /// Better not use this function in async context, or it would cause a deadlock.
+    pub fn blocking_send_command(&self, cmd: MegaCommands) {
         let _ = self.inner.send_blocking(cmd);
     }
-}
\ No newline at end of file
+}
diff --git a/monobean/src/core/mega_core.rs b/monobean/src/core/mega_core.rs
index b4f4f202..1edf1f8e 100644
--- a/monobean/src/core/mega_core.rs
+++ b/monobean/src/core/mega_core.rs
@@ -10,30 +10,48 @@ use std::fmt;
 use std::fmt::{Debug, Formatter};
 use std::net::SocketAddr;
 use std::path::PathBuf;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use tokio::sync::{oneshot, OnceCell, RwLock};
+use vault::pgp::{SignedPublicKey, SignedSecretKey};
 
 pub struct MegaCore {
-    config: Config,
-    running_context: Option<MegaContext>,
-    mount_point: Option<PathBuf>,
-    ssh_options: Option<SshOptions>,
-    http_options: Option<HttpOptions>,
-
-    mounted: bool,
-    
+    config: Arc<Config>,
+    running_context: Arc<RwLock<Option<MegaContext>>>,
+    mount_point: Arc<RwLock<Option<PathBuf>>>,
+    ssh_options: Arc<RwLock<Option<SshOptions>>>,
+    http_options: Arc<RwLock<Option<HttpOptions>>>,
+    pgp: OnceCell<(SignedPublicKey, SignedSecretKey)>,
+
+    initialized: AtomicBool,
+    mounted: AtomicBool,
+
     #[allow(dead_code)]
     sender: Sender<Action>,
     pub receiver: Receiver<MegaCommands>,
 }
 
 /// Mega Backend Related Actions
-#[derive(Debug, Clone)]
+#[derive(Debug)]
 pub enum MegaCommands {
     MegaStart(Option<SocketAddr>, Option<SocketAddr>),
     MegaShutdown,
     MegaRestart(Option<SocketAddr>, Option<SocketAddr>),
+    CoreStatus(
+        oneshot::Sender<(
+            /* core_running: */ bool,
+            /* pgp_initialized: */ bool,
+        )>,
+    ),
     FuseMount(PathBuf),
     FuseUnmount,
     SaveFileChange(PathBuf),
+    LoadOrInitPgp(
+        oneshot::Sender<MonoBeanResult<()>>,
+        String,         // User Name
+        String,         // User Email
+        Option<String>, // Passwd
+    ),
 }
 
 impl Debug for MegaCore {
@@ -54,22 +72,43 @@ impl MegaCore {
             Config::load_str(content.as_str()).expect("Failed to parse mega core settings");
 
         Self {
-            config,
+            config: Arc::from(config),
             running_context: Default::default(),
-            mount_point: None,
-            ssh_options: None,
-            http_options: None,
+            mount_point: Default::default(),
+            ssh_options: Default::default(),
+            http_options: Default::default(),
+            pgp: Default::default(),
 
-            mounted: false,
+            initialized: Default::default(),
+            mounted: Default::default(),
             sender,
             receiver,
         }
     }
 
-    /// Entry point of Mega Core.
-    /// ## Warning:
+    /// Processes a given `MegaCommands` command.
+    ///
+    /// # Arguments
+    ///
+    /// * `cmd` - A `MegaCommands` enum variant representing the command to be processed.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// let mut mega_core = MegaCore::new(sender, receiver);
+    /// mega_core.process_command(MegaCommands::MegaStart(None, None)).await;
+    /// ```
+    ///
+    /// # Warning
+    ///
     /// This function must be called in a tokio runtime.
-    pub(crate) async fn process_command(&mut self, cmd: MegaCommands) {
+    ///
+    /// # Deadlock (For Developers)
+    ///
+    /// Should not block sending an `Action` in main thread, or the code should be put in a `tokio::spawn` block.
+    pub(crate) async fn process_command(&self, cmd: MegaCommands) {
+        // FIXME: for command with callback channel, detect if `send` success.
+        tracing::debug!("Processing command: {:?}", cmd);
         match cmd {
             MegaCommands::MegaStart(http_addr, ssh_addr) => {
                 tracing::info!("Starting Mega Core");
@@ -77,78 +116,148 @@ impl MegaCore {
             }
             MegaCommands::MegaShutdown => {
                 tracing::info!("Shutting down Mega Core");
-                self.shutdown();
+                self.shutdown().await;
             }
             MegaCommands::MegaRestart(http_addr, ssh_addr) => {
                 tracing::info!("Restarting Mega Core");
-                self.shutdown();
+                self.shutdown().await;
                 self.launch(http_addr, ssh_addr).await.unwrap();
             }
+            MegaCommands::CoreStatus(sender) => {
+                let core_running = self.is_core_running().await;
+                let pgp_initialized = self.pgp.initialized();
+                sender.send((core_running, pgp_initialized)).unwrap();
+            }
             MegaCommands::FuseMount(path) => {
                 tracing::info!("Mounting fuse at {:?}", path);
-                self.mount_point = Some(path);
-                self.mounted = true;
+                let mut mp_lock = self.mount_point.write().await;
+                *mp_lock = Some(path);
+                self.mounted.store(true, Ordering::Relaxed);
             }
             MegaCommands::FuseUnmount => {
                 tracing::info!("Unmounting fuse");
-                self.mount_point = None;
-                self.mounted = false;
+                let mut mp_lock = self.mount_point.write().await;
+                *mp_lock = None;
+                self.mounted.store(false, Ordering::Relaxed);
             }
             MegaCommands::SaveFileChange(path) => {
                 tracing::info!("Saving file change at {:?}", path);
             }
+            MegaCommands::LoadOrInitPgp(back_chan, name, email, passwd) => {
+                if self.pgp.initialized() {
+                    back_chan.send(Err(MonoBeanError::ReinitError)).unwrap();
+                    return;
+                }
+
+                if let Some(pk) = vault::pgp::load_pub_key().await {
+                    let sk = vault::pgp::load_sec_key().await.unwrap();
+                    back_chan.send(Ok(())).unwrap();
+                    self.pgp.set((pk, sk)).unwrap();
+                } else {
+                    let uid = format!("{} <{}>", name, email);
+                    let params = vault::pgp::params(
+                        vault::pgp::KeyType::Rsa(2048),
+                        passwd.clone(),
+                        uid.as_ref(),
+                    );
+                    let (pk, sk) = vault::pgp::gen_pgp_keypair(params, passwd);
+                    vault::pgp::save_keys(pk.clone(), sk.clone()).await;
+                    back_chan.send(Ok(())).unwrap();
+                    self.pgp.set((pk, sk)).unwrap();
+                }
+            }
+        }
+    }
+
+    /// Initialize MegaCore at startup phrase.
+    ///
+    /// # Warning
+    ///
+    /// DO NOT add any blocking code here.
+    pub(crate) async fn init(&self) {
+        if self.initialized.load(Ordering::Acquire) {
+            tracing::error!("MegaCore is already initialized");
+            return;
+        } else {
+            self.initialized.store(true, Ordering::Release);
+        }
+        vault::pgp::delete_keys().await;
+
+        // Try to load pgp keys from vault.
+        if let Some(pk) = vault::pgp::load_pub_key().await {
+            let sk = vault::pgp::load_sec_key().await.unwrap();
+            self.pgp.set((pk, sk)).unwrap();
+            tracing::debug!("Loaded pgp keys from vault");
         }
     }
+
+    /// Launch Mega Http(s) and SSH servers.
     async fn launch(
-        &mut self,
+        &self,
         http_addr: Option<SocketAddr>,
         ssh_addr: Option<SocketAddr>,
     ) -> MonoBeanResult<()> {
-        if !self.is_core_running() {
-            let inner = MegaContext::new(self.config.clone()).await;
-            inner
-                .services
-                .mono_storage
-                .init_monorepo(&self.config.monorepo)
-                .await;
-
-            self.running_context = Some(inner);
-            self.http_options = http_addr.map(HttpOptions::new).or(None);
-            self.ssh_options = ssh_addr.map(SshOptions::new).or(None);
-        } else {
+        if self.is_core_running().await {
             let err = "Mega core is already running";
             tracing::error!(err);
             return Err(MonoBeanError::MegaCoreError(err.to_string()));
         }
 
-        // Affordable tradeoff for convenience
-        let http_clone = self.http_options.clone().unwrap();
-        let ssh_clone = self.ssh_options.clone().unwrap();
-        let (http_res, ssh_res) = tokio::join!(
-            http_clone.run_server(self.running_context.clone().unwrap()),
-            ssh_clone.run_server(self.running_context.clone().unwrap())
-        );
-
-        http_res.map_err(|e| {
-            MonoBeanError::MegaCoreError(format!("Failed to serve http: {}", e))
-        })?;
-        ssh_res.map_err(|e| {
-            MonoBeanError::MegaCoreError(format!("Failed to serve ssh: {}", e))
-        })?;
+        let inner = MegaContext::new((*self.config).clone()).await;
+        inner
+            .services
+            .mono_storage
+            .init_monorepo(&self.config.monorepo)
+            .await;
+
+        let http_ctx = inner.clone();
+        *self.http_options.write().await = http_addr.map(HttpOptions::new).or(None);
+        let http_opt = self.http_options.clone();
+        tokio::spawn(async move {
+            let opt = &*http_opt.read().await;
+            match opt {
+                Some(http_opt) => {
+                    let _ = http_opt.run_server(http_ctx).await;
+                }
+                None => {
+                    tracing::error!("Failed to start http server, http options is not initialized");
+                }
+            }
+        });
+
+        let ssh_ctx = inner.clone();
+        let ssh_opt = ssh_addr.map(SshOptions::new).or(None);
+        *self.ssh_options.write().await = ssh_opt;
+        let ssh_opt = self.ssh_options.clone();
+        tokio::spawn(async move {
+            let opt = &*ssh_opt.read().await;
+            match opt {
+                Some(ssh_opt) => {
+                    let _ = ssh_opt.run_server(ssh_ctx).await;
+                }
+                None => {
+                    tracing::error!("Failed to start ssh server, ssh options is not initialized");
+                }
+            }
+        });
+
+        *self.running_context.write().await = Some(inner);
         Ok(())
     }
 
-    fn shutdown(&mut self) {
-        if let Some(http_options) = self.http_options.as_ref() {
+    async fn shutdown(&self) {
+        if let Some(http_options) = &*self.http_options.read().await {
             http_options.shutdown_server();
         }
-        if let Some(ssh_options) = self.ssh_options.as_ref() {
+        if let Some(ssh_options) = &*self.ssh_options.read().await {
             ssh_options.shutdown_server();
         }
-        self.running_context = None;
+        *self.http_options.write().await = None;
+        *self.http_options.write().await = None;
+        *self.running_context.write().await = None;
     }
 
-    pub fn is_core_running(&self) -> bool {
-        self.running_context.is_some()
+    pub async fn is_core_running(&self) -> bool {
+        self.running_context.read().await.is_some()
     }
 }
diff --git a/monobean/src/core/servers.rs b/monobean/src/core/servers.rs
index 7c4d3cac..c99423d9 100644
--- a/monobean/src/core/servers.rs
+++ b/monobean/src/core/servers.rs
@@ -6,20 +6,19 @@ use jupiter::context::Context as MegaContext;
 use mono::git_protocol::ssh::SshServer;
 use mono::server::https_server::app;
 use russh::server::Server;
-use std::cell::RefCell;
 use std::collections::HashMap;
 use std::net::{IpAddr, SocketAddr};
-use std::sync::Arc;
+use std::sync::{Arc, OnceLock};
 use tokio::sync::{mpsc, Mutex};
 
 #[derive(Debug, Clone)]
-pub struct SshOptions {
+pub(crate) struct SshOptions {
     addr: SocketAddr,
-    abort: RefCell<Option<mpsc::Sender<()>>>,
+    abort: Arc<OnceLock<mpsc::Sender<()>>>,
 }
 
 #[derive(Debug, Clone)]
-pub struct HttpOptions {
+pub(crate) struct HttpOptions {
     addr: SocketAddr,
     handle: axum_server::Handle,
 }
@@ -34,9 +33,11 @@ impl HttpOptions {
         let app = app(mega_ctx, self.addr.ip().to_string(), self.addr.port()).await;
         let cert = crate::core::load_mega_resource(MEGA_HTTPS_CERT);
         let key = crate::core::load_mega_resource(MEGA_HTTPS_KEY);
-        
+
         // I don't know why I must manually install it, or it will panic on the next line...
-        rustls::crypto::ring::default_provider().install_default().unwrap();
+        rustls::crypto::ring::default_provider()
+            .install_default()
+            .unwrap();
         let tls_config = RustlsConfig::from_pem(cert, key).await;
 
         tracing::info!("Starting HTTPS server on: {}", self.addr);
@@ -70,14 +71,14 @@ impl Default for HttpOptions {
 
 impl SshOptions {
     pub fn new(addr: SocketAddr) -> Self {
-        let abort = RefCell::new(None);
+        let abort = Default::default();
         Self { addr, abort }
     }
 
     pub async fn run_server(&self, mega_ctx: MegaContext) -> MonoBeanResult<()> {
         // Use rusty vault configurations...
         let (tx, mut rx) = mpsc::channel::<()>(1);
-        *self.abort.borrow_mut() = Some(tx);
+        self.abort.set(tx).unwrap();
         let key = mono::server::ssh_server::load_key().await;
         let ssh_config = russh::server::Config {
             auth_rejection_time: std::time::Duration::from_secs(3),
@@ -109,8 +110,7 @@ impl SshOptions {
     }
 
     pub fn shutdown_server(&self) {
-        if self.abort.borrow().is_some() {
-            let abort = self.abort.borrow_mut().take().unwrap();
+        if let Some(abort) = self.abort.get() {
             if abort.try_send(()).is_ok() {
                 return;
             }
@@ -123,4 +123,4 @@ impl Default for SshOptions {
     fn default() -> Self {
         Self::new(SocketAddr::new(IpAddr::V4([0, 0, 0, 0].into()), 2222))
     }
-}
\ No newline at end of file
+}
diff --git a/monobean/src/error.rs b/monobean/src/error.rs
index a66eed4d..7b323a65 100644
--- a/monobean/src/error.rs
+++ b/monobean/src/error.rs
@@ -8,10 +8,13 @@ pub type MonoBeanResult<T> = Result<T, MonoBeanError>;
 pub enum MonoBeanError {
     #[error("Mega Core Error: {0}")]
     MegaCoreError(String),
-    
+
     #[error("Mega Protocol Error: {0}")]
     MegaProtocolError(#[from] ProtocolError),
-    
+
     #[error("Mega Server Error: {0}")]
     MegaServerError(#[from] std::io::Error),
-}
\ No newline at end of file
+
+    #[error("Reinitialization Error")]
+    ReinitError,
+}
diff --git a/monobean/src/main.rs b/monobean/src/main.rs
index 12120149..49e8aed9 100644
--- a/monobean/src/main.rs
+++ b/monobean/src/main.rs
@@ -10,9 +10,9 @@ use gtk::{gio, glib};
 mod application;
 mod components;
 mod config;
+mod core;
 mod error;
 mod window;
-mod core;
 
 pub static CONTEXT: LazyLock<glib::MainContext> = LazyLock::new(glib::MainContext::default);
 
diff --git a/monobean/src/window.rs b/monobean/src/window.rs
index d533f944..51a29b44 100644
--- a/monobean/src/window.rs
+++ b/monobean/src/window.rs
@@ -55,7 +55,7 @@ mod imp {
 
         pub sender: OnceCell<Sender<Action>>,
         pub settings: OnceCell<Settings>,
-        
+
         toast: RefCell<Option<Toast>>,
     }
 
@@ -76,20 +76,9 @@ mod imp {
     }
 
     impl ObjectImpl for MonobeanWindow {
-        fn constructed(&self) {
-            self.parent_constructed();
-            let obj = self.obj();
-            self.toast.replace(Some(Toast::new("")));
-
-            obj.bind_settings();
-        }
-
         fn properties() -> &'static [ParamSpec] {
-            static PROPERTIES: LazyLock<Vec<ParamSpec>> = LazyLock::new(|| {
-                vec![
-                    ParamSpecObject::builder::<Toast>("toast").build(),
-                ]
-            });
+            static PROPERTIES: LazyLock<Vec<ParamSpec>> =
+                LazyLock::new(|| vec![ParamSpecObject::builder::<Toast>("toast").build()]);
             PROPERTIES.as_ref()
         }
 
@@ -109,6 +98,14 @@ mod imp {
                 _ => unimplemented!(),
             }
         }
+
+        fn constructed(&self) {
+            self.parent_constructed();
+            let obj = self.obj();
+            self.toast.replace(Some(Toast::new("")));
+
+            obj.bind_settings();
+        }
     }
     impl WidgetImpl for MonobeanWindow {}
     impl WindowImpl for MonobeanWindow {}
@@ -164,10 +161,15 @@ impl MonobeanWindow {
         stack.set_visible_child_name("main_page");
     }
 
-    pub fn show_hello_page(&self, name: Option<String>, email: Option<String>) {
+    pub fn show_hello_page(
+        &self,
+        name: Option<String>,
+        email: Option<String>,
+        pgp_generated: bool,
+    ) {
         let stack = self.imp().base_stack.clone();
         let page = self.imp().hello_page.clone();
-        page.fill_entries(name, email);
+        page.fill_entries(name, email, pgp_generated);
         stack.set_visible_child_name("hello_page");
     }
 
@@ -186,6 +188,7 @@ impl MonobeanWindow {
         let toast = Toast::builder()
             .title(glib::markup_escape_text(&message))
             .priority(adw::ToastPriority::High)
+            .timeout(3)
             .build();
         self.set_property("toast", &toast);
         self.imp().toast_overlay.add_toast(toast);
diff --git a/vault/Cargo.toml b/vault/Cargo.toml
index 334b600f..a2a6f98f 100644
--- a/vault/Cargo.toml
+++ b/vault/Cargo.toml
@@ -15,3 +15,5 @@ serde = { version = "1.0.117", features = ["derive"] }
 secp256k1 = { workspace = true , features = ["serde", "rand","hashes"] }
 tokio = {workspace = true, features = ["full"]}
 async-std = "1.13.0"
+pgp = "0.15.0"
+smallvec = "1.6.1"
diff --git a/vault/src/lib.rs b/vault/src/lib.rs
index f2577d48..af390856 100644
--- a/vault/src/lib.rs
+++ b/vault/src/lib.rs
@@ -3,6 +3,7 @@ use secp256k1::{Keypair, Secp256k1};
 use crate::vault::{read_secret, write_secret};
 
 pub mod nostr;
+pub mod pgp;
 pub mod pki;
 pub mod vault;
 
diff --git a/vault/src/pgp.rs b/vault/src/pgp.rs
new file mode 100644
index 00000000..e890e479
--- /dev/null
+++ b/vault/src/pgp.rs
@@ -0,0 +1,238 @@
+use crate::vault::{delete_secret, read_secret, write_secret};
+use pgp::composed::Deserializable;
+/// This module provides functions for generating, loading, saving, and deleting PGP key pairs.
+///
+/// It uses the `pgp` crate for key generation and management, and stores the keys in a vault
+/// using asynchronous operations.
+pub use pgp::composed::{SignedPublicKey, SignedSecretKey};
+use pgp::types::SecretKeyTrait;
+pub use pgp::KeyType;
+use pgp::SecretKeyParams;
+use pgp::{SecretKeyParamsBuilder, SubkeyParamsBuilder};
+use smallvec::smallvec;
+
+const VAULT_KEY: &str = "pgp-signed-secret";
+
+/// Generates a PGP key pair (public and secret) based on the provided parameters.
+///
+/// # Arguments
+///
+/// *   `params`: The parameters for the secret key, such as key type, size, and usage flags.
+/// *   `passwd`: An optional passphrase to encrypt the secret key. If `None`, the key is not encrypted.
+///
+/// # Returns
+///
+/// A tuple containing the armored string representations of the public and secret keys.
+/// The first element is the public key, and the second is the secret key.
+pub fn gen_pgp_keypair(
+    params: SecretKeyParams,
+    passwd: Option<String>,
+) -> (SignedPublicKey, SignedSecretKey) {
+    let mut rng = secp256k1::rand::rngs::OsRng;
+    let key = params
+        .generate(rng)
+        .expect("failed to generate secret key, encrypted");
+
+    let signed_key = key
+        .sign(&mut rng, || {
+            if let Some(passwd) = passwd.clone() {
+                passwd
+            } else {
+                "".into()
+            }
+        })
+        .expect("failed to sign key");
+
+    let pub_key = signed_key.public_key();
+    let signed_pub = pub_key
+        .sign(rng, &signed_key, || {
+            if let Some(passwd) = passwd {
+                passwd
+            } else {
+                "".into()
+            }
+        })
+        .expect("failed to sign key");
+
+    (signed_pub, signed_key)
+}
+
+/// Loads the public key from the vault.
+///
+/// # Returns
+///
+/// An `Option` containing the `SignedPublicKey` if the key is found in the vault, otherwise `None`.
+pub async fn load_pub_key() -> Option<SignedPublicKey> {
+    let key = read_secret(VAULT_KEY).await.unwrap();
+    if let Some(key) = key {
+        let data = key.data.unwrap();
+        let key = data["pub_key"].as_str().unwrap();
+        let (key, _headers) = SignedPublicKey::from_string(key).expect("failed to parse key");
+        key.verify().expect("invalid key");
+        Some(key)
+    } else {
+        None
+    }
+}
+
+/// Loads the public key from the vault.
+///
+/// # Returns
+///
+/// An `Option` containing the `SignedPublicKey` if the key is found in the vault, otherwise `None`.
+pub async fn load_sec_key() -> Option<SignedSecretKey> {
+    let key = read_secret(VAULT_KEY).await.unwrap();
+    if let Some(key) = key {
+        let data = key.data.unwrap();
+        let key = data["sec_key"].as_str().unwrap();
+        let (key, _headers) = SignedSecretKey::from_string(key).expect("failed to parse key");
+        key.verify().expect("invalid key");
+        Some(key)
+    } else {
+        None
+    }
+}
+
+/// Saves the public and secret keys to the vault.
+///
+/// # Arguments
+///
+/// *   `pub_key`: The armored string representation of the public key.
+/// *   `sec_key`: The armored string representation of the secret key.
+///
+/// # Panics
+///
+/// When input is invalid.
+pub async fn save_keys(pub_key: SignedPublicKey, sec_key: SignedSecretKey) {
+    let pub_key = pub_key.to_armored_string(None.into()).unwrap();
+    let sec_key = sec_key.to_armored_string(None.into()).unwrap();
+    let data = serde_json::json!({
+        "pub_key": pub_key,
+        "sec_key": sec_key,
+    })
+    .as_object()
+    .unwrap()
+    .clone();
+    write_secret(VAULT_KEY, Some(data))
+        .await
+        .unwrap_or_else(|e| {
+            panic!("Failed to write PGP keys: {:?}", e);
+        });
+}
+
+/// Deletes the key pair from the vault.
+pub async fn delete_keys() {
+    delete_secret(VAULT_KEY).await.unwrap_or_else(|e| {
+        panic!("Failed to delete PGP keys: {:?}", e);
+    });
+}
+
+/// Creates a set of parameters for generating a PGP secret key.
+///
+/// This function simplifies the creation of `SecretKeyParams` by pre-configuring several options
+/// such as key version, key type, capabilities (certify and sign), preferred algorithms, and subkeys.
+///
+/// # Arguments
+///
+/// *   `key_type`: The type of key to generate (e.g., RSA, ECDSA).
+/// *   `passwd`: An optional passphrase to encrypt the secret key. If `None`, the key is not encrypted.
+/// *   `uid`: The user ID associated with the key. This is typically an email address or name.
+///
+/// # Returns
+///
+/// A `SecretKeyParams` object configured with the specified parameters, ready for key generation.
+pub fn params(key_type: pgp::KeyType, passwd: Option<String>, uid: &str) -> SecretKeyParams {
+    let version = pgp::types::KeyVersion::V6;
+
+    let mut key_params = SecretKeyParamsBuilder::default();
+    key_params
+        .version(version)
+        .key_type(key_type.clone())
+        .can_certify(true)
+        .can_sign(true)
+        .primary_user_id(uid.into())
+        .preferred_symmetric_algorithms(smallvec![
+            pgp::crypto::sym::SymmetricKeyAlgorithm::AES256,
+            pgp::crypto::sym::SymmetricKeyAlgorithm::AES192,
+            pgp::crypto::sym::SymmetricKeyAlgorithm::AES128,
+        ])
+        .preferred_hash_algorithms(smallvec![
+            pgp::crypto::hash::HashAlgorithm::SHA2_256,
+            pgp::crypto::hash::HashAlgorithm::SHA2_384,
+            pgp::crypto::hash::HashAlgorithm::SHA2_512,
+            pgp::crypto::hash::HashAlgorithm::SHA2_224,
+            pgp::crypto::hash::HashAlgorithm::SHA1,
+        ])
+        .preferred_compression_algorithms(smallvec![
+            pgp::types::CompressionAlgorithm::ZLIB,
+            pgp::types::CompressionAlgorithm::ZIP,
+        ])
+        .passphrase(passwd.clone())
+        .subkey(
+            SubkeyParamsBuilder::default()
+                .version(version)
+                .key_type(key_type)
+                .passphrase(passwd)
+                .can_encrypt(true)
+                .build()
+                .unwrap(),
+        )
+        .build()
+        .unwrap()
+}
+
+#[cfg(test)]
+mod tests {
+    use pgp::KeyType;
+
+    use super::*;
+
+    #[test]
+    fn test_gen_pgp_keypair() {
+        const PASSWD: &str = "hello";
+        const KEY_TYPE: KeyType = KeyType::Rsa(2048);
+        const UID: &str = "test";
+        let params = params(KEY_TYPE, Some(PASSWD.into()), UID);
+        let (pk, sk) = gen_pgp_keypair(params, Some(PASSWD.into()));
+
+        assert!(pk.verify().is_ok());
+        assert!(sk.verify().is_ok());
+    }
+
+    #[tokio::test]
+    async fn test_save_load_delete_keys() {
+        const PASSWD: &str = "hello";
+        const KEY_TYPE: KeyType = KeyType::Rsa(2048);
+        const UID: &str = "test";
+        let params = params(KEY_TYPE, Some(PASSWD.into()), UID);
+        let (pk, sk) = gen_pgp_keypair(params, Some(PASSWD.into()));
+
+        save_keys(pk.clone(), sk.clone()).await;
+
+        let loaded_pub_key = load_pub_key().await;
+        assert!(loaded_pub_key.is_some());
+        let loaded_pub_key = loaded_pub_key.unwrap();
+        assert!(loaded_pub_key.verify().is_ok());
+        assert_eq!(
+            loaded_pub_key.to_armored_string(None.into()).unwrap(),
+            pk.to_armored_string(None.into()).unwrap()
+        );
+
+        let loaded_sec_key = load_sec_key().await;
+        assert!(loaded_sec_key.is_some());
+        let loaded_sec_key = loaded_sec_key.unwrap();
+        assert!(loaded_sec_key.verify().is_ok());
+        assert_eq!(
+            loaded_sec_key.to_armored_string(None.into()).unwrap(),
+            sk.to_armored_string(None.into()).unwrap()
+        );
+
+        delete_keys().await;
+
+        let loaded_pub_key = load_pub_key().await;
+        assert!(loaded_pub_key.is_none());
+
+        let loaded_sec_key = load_sec_key().await;
+        assert!(loaded_sec_key.is_none());
+    }
+}
diff --git a/vault/src/vault.rs b/vault/src/vault.rs
index 1dc2315f..4f1d4693 100644
--- a/vault/src/vault.rs
+++ b/vault/src/vault.rs
@@ -133,6 +133,13 @@ pub async fn write_api(
     resp
 }
 
+pub async fn delete_api(core: &Core, token: &str, path: &str) -> Result<Option<Response>, RvError> {
+    let mut req = Request::new(path);
+    req.operation = Operation::Delete;
+    req.client_token = token.to_string();
+    core.handle_request(&mut req).await // !Send
+}
+
 /// Write a secret to the vault (k-v)
 pub async fn write_secret(
     name: &str,
@@ -157,6 +164,16 @@ pub async fn read_secret(name: &str) -> Result<Option<Response>, RvError> {
     ))
 }
 
+/// Delete a secret from the vault (k-v)
+pub async fn delete_secret(name: &str) -> Result<Option<Response>, RvError> {
+    // async_std: stop spread of `!Send` (RwLockReadGuard cross .await), for `tokio::spawn`
+    async_std::task::block_on(delete_api(
+        &CORE.core.read().unwrap(),
+        &CORE.token,
+        &format!("secret/{}", name),
+    ))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;