diff --git a/keyserver/addons/rust-node-addon/src/identity_client/compare_users.rs b/keyserver/addons/rust-node-addon/src/identity_client/compare_users.rs
index d46ff2965..7271c25cb 100644
--- a/keyserver/addons/rust-node-addon/src/identity_client/compare_users.rs
+++ b/keyserver/addons/rust-node-addon/src/identity_client/compare_users.rs
@@ -1,36 +1,38 @@
 use super::*;
 
 #[napi]
 #[instrument(skip_all)]
 async fn compare_users(
   users: Vec<String>,
 ) -> Result<HashMap<String, Vec<String>>> {
   let channel = get_identity_service_channel().await?;
   let token: MetadataValue<_> = IDENTITY_SERVICE_CONFIG
     .identity_auth_token
     .parse()
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
-  let mut identity_client =
-    IdentityServiceClient::with_interceptor(channel, |mut req: Request<()>| {
+  let mut identity_client = IdentityKeyserverServiceClient::with_interceptor(
+    channel,
+    |mut req: Request<()>| {
       req.metadata_mut().insert("authorization", token.clone());
       Ok(req)
-    });
+    },
+  );
   let request = Request::new(CompareUsersRequest { users: users });
 
   match identity_client.compare_users(request).await {
     Ok(tonic_response) => {
       let compare_users_response = tonic_response.into_inner();
       let mut compare_result = HashMap::new();
       compare_result.insert(
         "usersMissingFromKeyserver".to_string(),
         compare_users_response.users_missing_from_keyserver,
       );
       compare_result.insert(
         "usersMissingFromIdentity".to_string(),
         compare_users_response.users_missing_from_identity,
       );
       Ok(compare_result)
     }
     Err(e) => Err(Error::new(Status::GenericFailure, e.to_string())),
   }
 }
diff --git a/keyserver/addons/rust-node-addon/src/identity_client/delete_user.rs b/keyserver/addons/rust-node-addon/src/identity_client/delete_user.rs
index d02720efc..0ad2d5a40 100644
--- a/keyserver/addons/rust-node-addon/src/identity_client/delete_user.rs
+++ b/keyserver/addons/rust-node-addon/src/identity_client/delete_user.rs
@@ -1,26 +1,28 @@
 use super::*;
 
 #[napi]
 #[instrument(skip_all)]
 pub async fn delete_user(user_id: String) -> Result<()> {
   let channel = get_identity_service_channel().await?;
   let token: MetadataValue<_> = IDENTITY_SERVICE_CONFIG
     .identity_auth_token
     .parse()
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
-  let mut identity_client =
-    IdentityServiceClient::with_interceptor(channel, |mut req: Request<()>| {
+  let mut identity_client = IdentityKeyserverServiceClient::with_interceptor(
+    channel,
+    |mut req: Request<()>| {
       req.metadata_mut().insert("authorization", token.clone());
       Ok(req)
-    });
+    },
+  );
 
   let request = Request::new(DeleteUserRequest {
     user_id: user_id.clone(),
   });
   identity_client
     .delete_user(request)
     .await
     .map_err(|e| Error::new(Status::GenericFailure, e.to_string()))?;
 
   Ok(())
 }
diff --git a/keyserver/addons/rust-node-addon/src/identity_client/login_user.rs b/keyserver/addons/rust-node-addon/src/identity_client/login_user.rs
index 115fbf794..e5a6750f9 100644
--- a/keyserver/addons/rust-node-addon/src/identity_client/login_user.rs
+++ b/keyserver/addons/rust-node-addon/src/identity_client/login_user.rs
@@ -1,208 +1,212 @@
 use super::*;
 
 #[napi]
 #[instrument(skip_all)]
 async fn login_user_wallet(
   user_id: String,
   signing_public_key: String,
   siwe_message: String,
   siwe_signature: String,
   mut session_initialization_info: HashMap<String, String>,
   social_proof: String,
 ) -> Result<String> {
   let channel = get_identity_service_channel().await?;
   let token: MetadataValue<_> = IDENTITY_SERVICE_CONFIG
     .identity_auth_token
     .parse()
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
-  let mut identity_client =
-    IdentityServiceClient::with_interceptor(channel, |mut req: Request<()>| {
+  let mut identity_client = IdentityKeyserverServiceClient::with_interceptor(
+    channel,
+    |mut req: Request<()>| {
       req.metadata_mut().insert("authorization", token.clone());
       Ok(req)
-    });
+    },
+  );
 
   // Create a LoginRequest channel and use ReceiverStream to turn the
   // MPSC receiver into a Stream for outbound messages
   let (tx, rx) = mpsc::channel(1);
   let stream = ReceiverStream::new(rx);
   let request = Request::new(stream);
 
   let mut response_stream = identity_client
     .login_user(request)
     .await
     .map_err(|_| Error::from_status(Status::GenericFailure))?
     .into_inner();
 
   // Start wallet login on client and send initial login request to Identity
   // service
   session_initialization_info.insert("socialProof".to_string(), social_proof);
   let login_request = LoginRequest {
     data: Some(WalletLoginRequest(WalletLoginRequestStruct {
       user_id,
       signing_public_key,
       siwe_message,
       siwe_signature,
       session_initialization_info: Some(SessionInitializationInfo {
         info: session_initialization_info,
       }),
     })),
   };
   if let Err(e) = tx.send(login_request).await {
     error!("Response was dropped: {}", e);
     return Err(Error::from_status(Status::GenericFailure));
   }
 
   // Return access token
   let message = response_stream.message().await.map_err(|e| {
     error!("Received an error from inbound message stream: {}", e);
     Error::from_status(Status::GenericFailure)
   })?;
   get_wallet_access_token(message)
 }
 
 #[napi]
 #[instrument(skip_all)]
 async fn login_user_pake(
   user_id: String,
   signing_public_key: String,
   password: String,
   session_initialization_info: HashMap<String, String>,
 ) -> Result<String> {
   let channel = get_identity_service_channel().await?;
   let token: MetadataValue<_> = IDENTITY_SERVICE_CONFIG
     .identity_auth_token
     .parse()
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
-  let mut identity_client =
-    IdentityServiceClient::with_interceptor(channel, |mut req: Request<()>| {
+  let mut identity_client = IdentityKeyserverServiceClient::with_interceptor(
+    channel,
+    |mut req: Request<()>| {
       req.metadata_mut().insert("authorization", token.clone());
       Ok(req)
-    });
+    },
+  );
 
   // Create a LoginRequest channel and use ReceiverStream to turn the
   // MPSC receiver into a Stream for outbound messages
   let (tx, rx) = mpsc::channel(1);
   let stream = ReceiverStream::new(rx);
   let request = Request::new(stream);
 
   // `response` is the Stream for inbound messages
   let mut response = identity_client
     .login_user(request)
     .await
     .map_err(|_| Error::from_status(Status::GenericFailure))?
     .into_inner();
 
   // Start PAKE login on client and send initial login request to Identity
   // service
   let mut client_rng = OsRng;
   let client_login_start_result = pake_login_start(&mut client_rng, &password)?;
   let pake_credential_request =
     client_login_start_result.message.serialize().map_err(|e| {
       error!("Could not serialize credential request: {}", e);
       Error::new(Status::GenericFailure, e.to_string())
     })?;
   let login_request = LoginRequest {
     data: Some(PakeLoginRequest(PakeLoginRequestStruct {
       data: Some(PakeCredentialRequestAndUserId(
         PakeCredentialRequestAndUserIdStruct {
           user_id,
           signing_public_key,
           pake_credential_request,
           session_initialization_info: Some(SessionInitializationInfo {
             info: session_initialization_info,
           }),
         },
       )),
     })),
   };
 
   send_to_mpsc(tx.clone(), login_request).await?;
 
   // Handle responses from Identity service sequentially, making sure we get
   // messages in the correct order
 
   // Finish PAKE login; send final login request to Identity service
   let message = response.message().await.map_err(|e| {
     error!("Received an error from inbound message stream: {}", e);
     match e.code() {
       Code::NotFound => {
         Error::new(Status::InvalidArg, "user not found".to_string())
       }
       _ => Error::new(Status::GenericFailure, e.to_string()),
     }
   })?;
   handle_login_credential_response(
     message,
     client_login_start_result.state,
     tx,
   )
   .await?;
 
   // Return access token
   let message = response.message().await.map_err(|e| {
     error!("Received an error from inbound message stream: {}", e);
     Error::from_status(Status::GenericFailure)
   })?;
   handle_login_token_response(message)
 }
 
 async fn handle_login_credential_response(
   message: Option<LoginResponse>,
   client_login: ClientLogin<Cipher>,
   tx: mpsc::Sender<LoginRequest>,
 ) -> Result<(), Status> {
   if let Some(LoginResponse {
     data:
       Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
         data: Some(PakeCredentialResponse(credential_response_bytes)),
       })),
   }) = message
   {
     let credential_finalization_bytes =
       pake_login_finish(&credential_response_bytes, client_login)?
         .serialize()
         .map_err(|e| {
           error!("Could not serialize credential request: {}", e);
           Error::from_status(Status::GenericFailure)
         })?;
     let login_request = LoginRequest {
       data: Some(PakeLoginRequest(PakeLoginRequestStruct {
         data: Some(LoginPakeCredentialFinalization(
           credential_finalization_bytes,
         )),
       })),
     };
     send_to_mpsc(tx, login_request).await
   } else {
     Err(handle_unexpected_response(message))
   }
 }
 
 fn handle_login_token_response(
   message: Option<LoginResponse>,
 ) -> Result<String, Status> {
   if let Some(LoginResponse {
     data:
       Some(LoginPakeLoginResponse(PakeLoginResponseStruct {
         data: Some(AccessToken(access_token)),
       })),
   }) = message
   {
     Ok(access_token)
   } else {
     Err(handle_unexpected_response(message))
   }
 }
 
 fn get_wallet_access_token(
   message: Option<LoginResponse>,
 ) -> Result<String, Status> {
   if let Some(LoginResponse {
     data: Some(WalletLoginResponse(WalletLoginResponseStruct { access_token })),
   }) = message
   {
     Ok(access_token)
   } else {
     Err(handle_unexpected_response(message))
   }
 }
diff --git a/keyserver/addons/rust-node-addon/src/identity_client/mod.rs b/keyserver/addons/rust-node-addon/src/identity_client/mod.rs
index ba247d6ec..4503def77 100644
--- a/keyserver/addons/rust-node-addon/src/identity_client/mod.rs
+++ b/keyserver/addons/rust-node-addon/src/identity_client/mod.rs
@@ -1,139 +1,139 @@
 pub mod compare_users;
 pub mod delete_user;
 pub mod login_user;
 pub mod register_user;
 pub mod identity {
-  tonic::include_proto!("identity");
+  tonic::include_proto!("identity.keyserver");
 }
 pub mod update_user;
 
 use comm_opaque::Cipher;
-use identity::identity_service_client::IdentityServiceClient;
+use identity::identity_keyserver_service_client::IdentityKeyserverServiceClient;
 use identity::{
   login_request::Data::PakeLoginRequest,
   login_request::Data::WalletLoginRequest,
   login_response::Data::PakeLoginResponse as LoginPakeLoginResponse,
   login_response::Data::WalletLoginResponse,
   pake_login_request::Data::PakeCredentialFinalization as LoginPakeCredentialFinalization,
   pake_login_request::Data::PakeCredentialRequestAndUserId,
   pake_login_response::Data::AccessToken,
   pake_login_response::Data::PakeCredentialResponse,
   registration_request::Data::PakeCredentialFinalization as RegistrationPakeCredentialFinalization,
   registration_request::Data::PakeRegistrationRequestAndUserId,
   registration_request::Data::PakeRegistrationUploadAndCredentialRequest,
   registration_response::Data::PakeLoginResponse as RegistrationPakeLoginResponse,
   registration_response::Data::PakeRegistrationResponse, CompareUsersRequest,
   DeleteUserRequest, LoginRequest, LoginResponse,
   PakeCredentialRequestAndUserId as PakeCredentialRequestAndUserIdStruct,
   PakeLoginRequest as PakeLoginRequestStruct,
   PakeLoginResponse as PakeLoginResponseStruct,
   PakeRegistrationRequestAndUserId as PakeRegistrationRequestAndUserIdStruct,
   PakeRegistrationUploadAndCredentialRequest as PakeRegistrationUploadAndCredentialRequestStruct,
   RegistrationRequest, RegistrationResponse as RegistrationResponseMessage,
   SessionInitializationInfo, WalletLoginRequest as WalletLoginRequestStruct,
   WalletLoginResponse as WalletLoginResponseStruct,
 };
 use lazy_static::lazy_static;
 use napi::bindgen_prelude::*;
 use opaque_ke::{
   ClientLogin, ClientLoginFinishParameters, ClientLoginStartParameters,
   ClientLoginStartResult, ClientRegistration,
   ClientRegistrationFinishParameters, CredentialFinalization,
   CredentialResponse, RegistrationResponse, RegistrationUpload,
 };
 use rand::{rngs::OsRng, CryptoRng, Rng};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::env::var;
 use tokio::sync::mpsc;
 use tokio_stream::wrappers::ReceiverStream;
 use tonic::{metadata::MetadataValue, transport::Channel, Code, Request};
 use tracing::{error, instrument};
 
 lazy_static! {
   static ref IDENTITY_SERVICE_CONFIG: IdentityServiceConfig = {
     let config_json_string =
       var("COMM_JSONCONFIG_secrets_identity_service_config");
     match config_json_string {
       Ok(json) => serde_json::from_str(&json).unwrap(),
       Err(_) => IdentityServiceConfig::default(),
     }
   };
 }
 
 #[derive(Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct IdentityServiceConfig {
   identity_socket_addr: String,
   identity_auth_token: String,
 }
 
 impl Default for IdentityServiceConfig {
   fn default() -> Self {
     Self {
       identity_socket_addr: "https://[::1]:50051".to_string(),
       identity_auth_token: "test".to_string(),
     }
   }
 }
 
 fn handle_unexpected_response<T: std::fmt::Debug>(message: Option<T>) -> Error {
   error!("Received an unexpected message: {:?}", message);
   Error::from_status(Status::GenericFailure)
 }
 
 async fn send_to_mpsc<T>(tx: mpsc::Sender<T>, request: T) -> Result<()> {
   if let Err(e) = tx.send(request).await {
     error!("Response was dropped: {}", e);
     return Err(Error::from_status(Status::GenericFailure));
   }
   Ok(())
 }
 
 fn pake_login_start(
   rng: &mut (impl Rng + CryptoRng),
   password: &str,
 ) -> Result<ClientLoginStartResult<Cipher>> {
   ClientLogin::<Cipher>::start(
     rng,
     password.as_bytes(),
     ClientLoginStartParameters::default(),
   )
   .map_err(|e| {
     error!("Failed to start PAKE login: {}", e);
     Error::from_status(Status::GenericFailure)
   })
 }
 
 fn pake_login_finish(
   credential_response_bytes: &[u8],
   client_login: ClientLogin<Cipher>,
 ) -> Result<CredentialFinalization<Cipher>> {
   client_login
     .finish(
       CredentialResponse::deserialize(credential_response_bytes).map_err(
         |e| {
           error!("Could not deserialize credential response bytes: {}", e);
           Error::from_status(Status::GenericFailure)
         },
       )?,
       ClientLoginFinishParameters::default(),
     )
     .map_err(|e| {
       error!("Failed to finish PAKE login: {}", e);
       Error::from_status(Status::GenericFailure)
     })
     .map(|res| res.message)
 }
 
 async fn get_identity_service_channel() -> Result<Channel> {
   Channel::from_static(&IDENTITY_SERVICE_CONFIG.identity_socket_addr)
     .connect()
     .await
     .map_err(|_| {
       Error::new(
         Status::GenericFailure,
         "Unable to connect to identity service".to_string(),
       )
     })
 }
diff --git a/keyserver/addons/rust-node-addon/src/identity_client/register_user.rs b/keyserver/addons/rust-node-addon/src/identity_client/register_user.rs
index 81eb2b8da..a8e9c2f55 100644
--- a/keyserver/addons/rust-node-addon/src/identity_client/register_user.rs
+++ b/keyserver/addons/rust-node-addon/src/identity_client/register_user.rs
@@ -1,228 +1,230 @@
 use super::*;
 
 #[napi]
 #[instrument(skip_all)]
 pub async fn register_user(
   user_id: String,
   signing_public_key: String,
   username: String,
   password: String,
   session_initialization_info: HashMap<String, String>,
 ) -> Result<String> {
   let channel = get_identity_service_channel().await?;
   let token: MetadataValue<_> = IDENTITY_SERVICE_CONFIG
     .identity_auth_token
     .parse()
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
-  let mut identity_client =
-    IdentityServiceClient::with_interceptor(channel, |mut req: Request<()>| {
+  let mut identity_client = IdentityKeyserverServiceClient::with_interceptor(
+    channel,
+    |mut req: Request<()>| {
       req.metadata_mut().insert("authorization", token.clone());
       Ok(req)
-    });
+    },
+  );
 
   // Create a RegistrationRequest channel and use ReceiverStream to turn the
   // MPSC receiver into a Stream for outbound messages
   let (tx, rx) = mpsc::channel(1);
   let stream = ReceiverStream::new(rx);
   let request = Request::new(stream);
 
   // `response` is the Stream for inbound messages
   let mut response = identity_client
     .register_user(request)
     .await
     .map_err(|_| Error::from_status(Status::GenericFailure))?
     .into_inner();
 
   // Start PAKE registration on client and send initial registration request
   // to Identity service
   let mut client_rng = OsRng;
   let (registration_request, client_registration) = pake_registration_start(
     &mut client_rng,
     user_id,
     signing_public_key,
     &password,
     username,
     SessionInitializationInfo {
       info: session_initialization_info,
     },
   )?;
   send_to_mpsc(tx.clone(), registration_request).await?;
 
   // Handle responses from Identity service sequentially, making sure we get
   // messages in the correct order
 
   // Finish PAKE registration and begin PAKE login; send the final
   // registration request and initial login request together to reduce the
   // number of trips
   let message = response
     .message()
     .await
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
   let client_login = handle_registration_response(
     message,
     &mut client_rng,
     client_registration,
     &password,
     tx.clone(),
   )
   .await?;
 
   // Finish PAKE login; send final login request to Identity service
   let message = response
     .message()
     .await
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
   handle_registration_credential_response(message, client_login, tx)
     .await
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
 
   // Return access token
   let message = response
     .message()
     .await
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
   handle_registration_token_response(message)
 }
 
 async fn handle_registration_response(
   message: Option<RegistrationResponseMessage>,
   client_rng: &mut (impl Rng + CryptoRng),
   client_registration: ClientRegistration<Cipher>,
   password: &str,
   tx: mpsc::Sender<RegistrationRequest>,
 ) -> Result<ClientLogin<Cipher>> {
   if let Some(RegistrationResponseMessage {
     data: Some(PakeRegistrationResponse(registration_response_bytes)),
     ..
   }) = message
   {
     let pake_registration_upload = pake_registration_finish(
       client_rng,
       &registration_response_bytes,
       client_registration,
     )?
     .serialize();
     let client_login_start_result = pake_login_start(client_rng, password)?;
 
     // `registration_request` is a gRPC message containing serialized bytes to
     // complete PAKE registration and begin PAKE login
     let registration_request = RegistrationRequest {
       data: Some(PakeRegistrationUploadAndCredentialRequest(
         PakeRegistrationUploadAndCredentialRequestStruct {
           pake_registration_upload,
           pake_credential_request: client_login_start_result
             .message
             .serialize()
             .map_err(|e| {
               error!("Could not serialize credential request: {}", e);
               Error::from_status(Status::GenericFailure)
             })?,
         },
       )),
     };
     send_to_mpsc(tx, registration_request).await?;
     Ok(client_login_start_result.state)
   } else {
     Err(handle_unexpected_response(message))
   }
 }
 
 async fn handle_registration_credential_response(
   message: Option<RegistrationResponseMessage>,
   client_login: ClientLogin<Cipher>,
   tx: mpsc::Sender<RegistrationRequest>,
 ) -> Result<()> {
   if let Some(RegistrationResponseMessage {
     data:
       Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
         data: Some(PakeCredentialResponse(credential_response_bytes)),
       })),
   }) = message
   {
     let registration_request = RegistrationRequest {
       data: Some(RegistrationPakeCredentialFinalization(
         pake_login_finish(&credential_response_bytes, client_login)?
           .serialize()
           .map_err(|e| {
             error!("Could not serialize credential request: {}", e);
             Error::from_status(Status::GenericFailure)
           })?,
       )),
     };
     send_to_mpsc(tx, registration_request).await
   } else {
     Err(handle_unexpected_response(message))
   }
 }
 
 fn handle_registration_token_response(
   message: Option<RegistrationResponseMessage>,
 ) -> Result<String> {
   if let Some(RegistrationResponseMessage {
     data:
       Some(RegistrationPakeLoginResponse(PakeLoginResponseStruct {
         data: Some(AccessToken(access_token)),
       })),
   }) = message
   {
     Ok(access_token)
   } else {
     Err(handle_unexpected_response(message))
   }
 }
 
 fn pake_registration_start(
   rng: &mut (impl Rng + CryptoRng),
   user_id: String,
   signing_public_key: String,
   password: &str,
   username: String,
   session_initialization_info: SessionInitializationInfo,
 ) -> Result<(RegistrationRequest, ClientRegistration<Cipher>)> {
   let client_registration_start_result =
     ClientRegistration::<Cipher>::start(rng, password.as_bytes()).map_err(
       |e| {
         error!("Failed to start PAKE registration: {}", e);
         Error::from_status(Status::GenericFailure)
       },
     )?;
   let pake_registration_request =
     client_registration_start_result.message.serialize();
   Ok((
     RegistrationRequest {
       data: Some(PakeRegistrationRequestAndUserId(
         PakeRegistrationRequestAndUserIdStruct {
           user_id,
           pake_registration_request,
           username,
           signing_public_key,
           session_initialization_info: Some(session_initialization_info),
         },
       )),
     },
     client_registration_start_result.state,
   ))
 }
 
 fn pake_registration_finish(
   rng: &mut (impl Rng + CryptoRng),
   registration_response_bytes: &[u8],
   client_registration: ClientRegistration<Cipher>,
 ) -> Result<RegistrationUpload<Cipher>> {
   client_registration
     .finish(
       rng,
       RegistrationResponse::deserialize(registration_response_bytes).map_err(
         |e| {
           error!("Could not deserialize registration response bytes: {}", e);
           Error::from_status(Status::GenericFailure)
         },
       )?,
       ClientRegistrationFinishParameters::default(),
     )
     .map_err(|e| {
       error!("Failed to finish PAKE registration: {}", e);
       Error::from_status(Status::GenericFailure)
     })
     .map(|res| res.message)
 }
diff --git a/keyserver/addons/rust-node-addon/src/identity_client/update_user.rs b/keyserver/addons/rust-node-addon/src/identity_client/update_user.rs
index 2458a9391..f4bd4a1e5 100644
--- a/keyserver/addons/rust-node-addon/src/identity_client/update_user.rs
+++ b/keyserver/addons/rust-node-addon/src/identity_client/update_user.rs
@@ -1,311 +1,311 @@
 use crate::identity_client::identity as proto;
-use crate::identity_client::identity::identity_service_client::IdentityServiceClient;
 use crate::identity_client::identity::pake_login_response::Data::AccessToken;
 use crate::identity_client::identity::{
   update_user_request, update_user_response, UpdateUserRequest,
   UpdateUserResponse,
 };
 use comm_opaque::Cipher;
 use napi::bindgen_prelude::*;
 use opaque_ke::{
   ClientLogin, ClientLoginFinishParameters, ClientLoginStartParameters,
   ClientLoginStartResult, ClientRegistration,
   ClientRegistrationFinishParameters, CredentialFinalization,
   CredentialResponse, RegistrationUpload,
 };
+use proto::identity_keyserver_service_client::IdentityKeyserverServiceClient;
 use rand::{rngs::OsRng, CryptoRng, Rng};
 use tokio::sync::mpsc;
 use tokio_stream::wrappers::ReceiverStream;
 use tonic;
 use tonic::metadata::MetadataValue;
 use tracing::{error, instrument};
 
 use super::{get_identity_service_channel, IDENTITY_SERVICE_CONFIG};
 
 #[napi]
 #[instrument(skip_all)]
 pub async fn update_user(user_id: String, password: String) -> Result<String> {
   let channel = get_identity_service_channel().await?;
   let token: MetadataValue<_> = IDENTITY_SERVICE_CONFIG
     .identity_auth_token
     .parse()
     .map_err(|_| Error::from_status(Status::GenericFailure))?;
-  let mut identity_client = IdentityServiceClient::with_interceptor(
+  let mut identity_client = IdentityKeyserverServiceClient::with_interceptor(
     channel,
     |mut req: tonic::Request<()>| {
       req.metadata_mut().insert("authorization", token.clone());
       Ok(req)
     },
   );
 
   // Create a RegistrationRequest channel and use ReceiverStream to turn the
   // MPSC receiver into a Stream for outbound messages
   let (tx, rx) = mpsc::channel(1);
   let stream = ReceiverStream::new(rx);
   let request = tonic::Request::new(stream);
 
   // `response` is the Stream for inbound messages
   let mut response = identity_client
     .update_user(request)
     .await
     .map_err(|e| Error::new(Status::GenericFailure, e.to_string()))?
     .into_inner();
 
   // Start PAKE registration on client and send initial registration request
   // to Identity service
   let mut client_rng = OsRng;
   let (registration_request, client_registration) =
     pake_registration_start(&mut client_rng, user_id, &password)?;
   send_to_mpsc(&tx, registration_request).await?;
 
   // Handle responses from Identity service sequentially, making sure we get
   // messages in the correct order
 
   // Finish PAKE registration and begin PAKE login; send the final
   // registration request and initial login request together to reduce the
   // number of trips
   let message = response
     .message()
     .await
     .map_err(|e| Error::new(Status::GenericFailure, e.to_string()))?;
   let registration_response = get_registration_response(message)?;
   let client_login = handle_registration_response(
     &registration_response,
     &mut client_rng,
     client_registration,
     &password,
     &tx,
   )
   .await?;
 
   // Finish PAKE login; send final login request to Identity service
   let message = response
     .message()
     .await
     .map_err(|e| Error::new(Status::GenericFailure, e.to_string()))?;
   let credential_response = get_login_credential_response(message)?;
   handle_login_credential_response(&credential_response, client_login, &tx)
     .await
     .map_err(|e| Error::new(Status::GenericFailure, e.to_string()))?;
 
   // Return access token
   let message = response
     .message()
     .await
     .map_err(|e| Error::new(Status::GenericFailure, e.to_string()))?;
   get_login_token_response(message)
 }
 
 fn handle_unexpected_response<T: std::fmt::Debug>(message: Option<T>) -> Error {
   error!("Received an unexpected message: {:?}", message);
   Error::from_status(Status::GenericFailure)
 }
 
 async fn send_to_mpsc<T>(tx: &mpsc::Sender<T>, request: T) -> Result<()> {
   if let Err(e) = tx.send(request).await {
     error!("Response was dropped: {}", e);
     return Err(Error::from_status(Status::GenericFailure));
   }
   Ok(())
 }
 
 fn pake_login_start(
   rng: &mut (impl Rng + CryptoRng),
   password: &str,
 ) -> Result<ClientLoginStartResult<Cipher>> {
   ClientLogin::<Cipher>::start(
     rng,
     password.as_bytes(),
     ClientLoginStartParameters::default(),
   )
   .map_err(|e| {
     error!("Failed to start PAKE login: {}", e);
     Error::from_status(Status::GenericFailure)
   })
 }
 
 fn pake_login_finish(
   credential_response_bytes: &[u8],
   client_login: ClientLogin<Cipher>,
 ) -> Result<CredentialFinalization<Cipher>> {
   client_login
     .finish(
       CredentialResponse::deserialize(credential_response_bytes).map_err(
         |e| {
           error!("Could not deserialize credential response bytes: {}", e);
           Error::from_status(Status::GenericFailure)
         },
       )?,
       ClientLoginFinishParameters::default(),
     )
     .map_err(|e| {
       error!("Failed to finish PAKE login: {}", e);
       Error::from_status(Status::GenericFailure)
     })
     .map(|res| res.message)
 }
 
 fn pake_registration_start(
   rng: &mut (impl Rng + CryptoRng),
   user_id: String,
   password: &str,
 ) -> Result<(UpdateUserRequest, ClientRegistration<Cipher>)> {
   let client_registration_start_result =
     ClientRegistration::<Cipher>::start(rng, password.as_bytes()).map_err(
       |e| {
         error!("Failed to start PAKE registration: {}", e);
         Error::from_status(Status::GenericFailure)
       },
     )?;
   let pake_registration_request =
     client_registration_start_result.message.serialize();
   Ok((
     UpdateUserRequest {
       data: Some(update_user_request::Data::Request(
         crate::identity_client::identity::PakeRegistrationRequestAndUserId {
           user_id,
           pake_registration_request,
           username: "placeholder-username".to_string(),
           signing_public_key: "placeholder-signing-public-key".to_string(),
           session_initialization_info: None,
         },
       )),
     },
     client_registration_start_result.state,
   ))
 }
 
 async fn handle_registration_response(
   registration_reponse_payload: &[u8],
   client_rng: &mut (impl Rng + CryptoRng),
   client_registration: ClientRegistration<Cipher>,
   password: &str,
   tx: &mpsc::Sender<UpdateUserRequest>,
 ) -> Result<ClientLogin<Cipher>> {
   let pake_registration_upload = pake_registration_finish(
     client_rng,
     &registration_reponse_payload,
     client_registration,
   )?
   .serialize();
   let client_login_start_result = pake_login_start(client_rng, password)?;
   let pake_login_request =
     client_login_start_result.message.serialize().map_err(|e| {
       error!("Could not serialize credential request: {}", e);
       Error::from_status(Status::GenericFailure)
     })?;
 
   // `registration_request` is a gRPC message containing serialized bytes to
   // complete PAKE registration and begin PAKE login
   let inner_message: update_user_request::Data =
     update_user_request::Data::PakeRegistrationUploadAndCredentialRequest(
       crate::identity_client::identity::PakeRegistrationUploadAndCredentialRequest {
         pake_registration_upload,
         pake_credential_request: pake_login_request,
       },
     );
   let registration_request = UpdateUserRequest {
     data: Some(inner_message),
   };
   send_to_mpsc(tx, registration_request).await?;
   Ok(client_login_start_result.state)
 }
 
 fn get_registration_response(
   message: Option<UpdateUserResponse>,
 ) -> Result<Vec<u8>> {
   match message {
     Some(UpdateUserResponse {
       data:
         Some(update_user_response::Data::PakeRegistrationResponse(
           registration_response_bytes,
         )),
       ..
     }) => Ok(registration_response_bytes),
     _ => {
       error!("Received an unexpected message: {:?}", message);
       Err(Error::from_status(Status::GenericFailure))
     }
   }
 }
 
 async fn handle_login_credential_response(
   registration_response_payload: &[u8],
   client_login: ClientLogin<Cipher>,
   tx: &mpsc::Sender<UpdateUserRequest>,
 ) -> Result<()> {
   let pake_login_finish_result =
     pake_login_finish(&registration_response_payload, client_login)?;
   let login_finish_message =
     pake_login_finish_result.serialize().map_err(|e| {
       error!("Could not serialize credential request: {}", e);
       Error::from_status(Status::GenericFailure)
     })?;
   let registration_request = UpdateUserRequest {
     data: Some(
       proto::update_user_request::Data::PakeLoginFinalizationMessage(
         login_finish_message,
       ),
     ),
   };
   send_to_mpsc(tx, registration_request).await
 }
 
 fn get_login_credential_response(
   message: Option<UpdateUserResponse>,
 ) -> Result<Vec<u8>> {
   match message {
     Some(UpdateUserResponse {
       data:
         Some(update_user_response::Data::PakeLoginResponse(
           proto::PakeLoginResponse {
             data:
               Some(proto::pake_login_response::Data::PakeCredentialResponse(
                 bytes,
               )),
           },
         )),
     }) => Ok(bytes),
     _ => Err(handle_unexpected_response(message)),
   }
 }
 
 fn get_login_token_response(
   message: Option<UpdateUserResponse>,
 ) -> Result<String> {
   match message {
     Some(UpdateUserResponse {
       data:
         Some(update_user_response::Data::PakeLoginResponse(
           proto::PakeLoginResponse {
             data: Some(AccessToken(access_token)),
           },
         )),
     }) => Ok(access_token),
     _ => Err(handle_unexpected_response(message)),
   }
 }
 
 fn pake_registration_finish(
   rng: &mut (impl Rng + CryptoRng),
   registration_response_bytes: &[u8],
   client_registration: ClientRegistration<Cipher>,
 ) -> Result<RegistrationUpload<Cipher>> {
   let register_payload =
     opaque_ke::RegistrationResponse::deserialize(registration_response_bytes)
       .map_err(|e| {
       error!("Could not deserialize registration response bytes: {}", e);
       Error::from_status(Status::GenericFailure)
     })?;
   client_registration
     .finish(
       rng,
       register_payload,
       ClientRegistrationFinishParameters::default(),
     )
     .map_err(|e| {
       error!("Failed to finish PAKE registration: {}", e);
       Error::from_status(Status::GenericFailure)
     })
     .map(|res| res.message)
 }
diff --git a/native/native_rust_library/src/lib.rs b/native/native_rust_library/src/lib.rs
index 6dbb64346..8340bec39 100644
--- a/native/native_rust_library/src/lib.rs
+++ b/native/native_rust_library/src/lib.rs
@@ -1,196 +1,196 @@
 use lazy_static::lazy_static;
 use std::sync::Arc;
 use tokio::runtime::{Builder, Runtime};
 use tonic::{transport::Channel, Status};
 use tracing::instrument;
 use tunnelbroker::tunnelbroker_service_client::TunnelbrokerServiceClient;
 
 mod crypto_tools;
 mod identity_client;
 mod identity {
-  tonic::include_proto!("identity");
+  tonic::include_proto!("identity.keyserver");
 }
 mod tunnelbroker {
   tonic::include_proto!("tunnelbroker");
 }
 
 use crypto_tools::generate_device_id;
-use identity::identity_service_client::IdentityServiceClient;
+use identity::identity_keyserver_service_client::IdentityKeyserverServiceClient;
 
 lazy_static! {
   pub static ref RUNTIME: Arc<Runtime> = Arc::new(
     Builder::new_multi_thread()
       .worker_threads(1)
       .max_blocking_threads(1)
       .enable_all()
       .build()
       .unwrap()
   );
 }
 
 #[cxx::bridge]
 mod ffi {
 
   enum DeviceType {
     KEYSERVER,
     WEB,
     MOBILE,
   }
 
   extern "Rust" {
     // Identity Service Client
     type IdentityClient;
 
     #[cxx_name = "identityInitializeClient"]
     fn initialize_identity_client(addr: String) -> Box<IdentityClient>;
 
     #[cxx_name = "identityGetUserIdBlocking"]
     fn identity_get_user_id_blocking(
       client: Box<IdentityClient>,
       auth_type: i32,
       user_info: String,
     ) -> Result<String>;
 
     #[cxx_name = "identityVerifyUserTokenBlocking"]
     fn identity_verify_user_token_blocking(
       client: Box<IdentityClient>,
       user_id: String,
       signing_public_key: String,
       access_token: String,
     ) -> Result<bool>;
 
     #[cxx_name = "identityRegisterUserBlocking"]
     fn identity_register_user_blocking(
       client: Box<IdentityClient>,
       user_id: String,
       signing_public_key: String,
       username: String,
       password: String,
     ) -> Result<String>;
 
     #[cxx_name = "identityLoginUserPakeBlocking"]
     fn identity_login_user_pake_blocking(
       client: Box<IdentityClient>,
       user_id: String,
       signing_public_key: String,
       password: String,
     ) -> Result<String>;
 
     #[cxx_name = "identityLoginUserWalletBlocking"]
     fn identity_login_user_wallet_blocking(
       client: Box<IdentityClient>,
       user_id: String,
       signing_public_key: String,
       siwe_message: String,
       siwe_signature: String,
     ) -> Result<String>;
 
     // Tunnelbroker Service Client
     type TunnelbrokerClient;
 
     #[cxx_name = "TunnelbrokerInitializeClient"]
     fn initialize_tunnelbroker_client(addr: String) -> Box<TunnelbrokerClient>;
 
     // Crypto Tools
     fn generate_device_id(device_type: DeviceType) -> Result<String>;
   }
 }
 
 #[derive(Debug)]
 pub struct IdentityClient {
-  identity_client: IdentityServiceClient<Channel>,
+  identity_client: IdentityKeyserverServiceClient<Channel>,
 }
 
 fn initialize_identity_client(addr: String) -> Box<IdentityClient> {
   Box::new(IdentityClient {
     identity_client: RUNTIME
-      .block_on(IdentityServiceClient::connect(addr))
+      .block_on(IdentityKeyserverServiceClient::connect(addr))
       .unwrap(),
   })
 }
 
 #[instrument]
 fn identity_get_user_id_blocking(
   client: Box<IdentityClient>,
   auth_type: i32,
   user_info: String,
 ) -> Result<String, Status> {
   RUNTIME.block_on(identity_client::get_user_id(client, auth_type, user_info))
 }
 
 #[instrument]
 fn identity_verify_user_token_blocking(
   client: Box<IdentityClient>,
   user_id: String,
   signing_public_key: String,
   access_token: String,
 ) -> Result<bool, Status> {
   RUNTIME.block_on(identity_client::verify_user_token(
     client,
     user_id,
     signing_public_key,
     access_token,
   ))
 }
 
 #[instrument]
 fn identity_register_user_blocking(
   client: Box<IdentityClient>,
   user_id: String,
   signing_public_key: String,
   username: String,
   password: String,
 ) -> Result<String, Status> {
   RUNTIME.block_on(identity_client::register_user(
     client,
     user_id,
     signing_public_key,
     username,
     password,
   ))
 }
 
 #[instrument]
 fn identity_login_user_pake_blocking(
   client: Box<IdentityClient>,
   user_id: String,
   signing_public_key: String,
   password: String,
 ) -> Result<String, Status> {
   RUNTIME.block_on(identity_client::login_user_pake(
     client,
     user_id,
     signing_public_key,
     password,
   ))
 }
 
 #[instrument]
 fn identity_login_user_wallet_blocking(
   client: Box<IdentityClient>,
   user_id: String,
   signing_public_key: String,
   siwe_message: String,
   siwe_signature: String,
 ) -> Result<String, Status> {
   RUNTIME.block_on(identity_client::login_user_wallet(
     client,
     user_id,
     signing_public_key,
     siwe_message,
     siwe_signature,
   ))
 }
 
 #[derive(Debug)]
 pub struct TunnelbrokerClient {
   tunnelbroker_client: TunnelbrokerServiceClient<Channel>,
 }
 
 fn initialize_tunnelbroker_client(addr: String) -> Box<TunnelbrokerClient> {
   Box::new(TunnelbrokerClient {
     tunnelbroker_client: RUNTIME
       .block_on(TunnelbrokerServiceClient::connect(addr))
       .expect("Failed to create Tokio runtime for the Tunnelbroker client"),
   })
 }
diff --git a/services/identity/src/main.rs b/services/identity/src/main.rs
index 9bd65c064..3cdbb0399 100644
--- a/services/identity/src/main.rs
+++ b/services/identity/src/main.rs
@@ -1,66 +1,67 @@
 use clap::{Parser, Subcommand};
 use database::DatabaseClient;
 use interceptor::check_auth;
 use tonic::transport::Server;
 use tracing_subscriber::FmtSubscriber;
 
 mod config;
 mod constants;
 mod database;
 mod interceptor;
 mod keygen;
 mod nonce;
 mod pake_grpc;
 mod service;
 mod token;
 
 use config::load_config;
 use constants::{IDENTITY_SERVICE_SOCKET_ADDR, SECRETS_DIRECTORY};
 use keygen::generate_and_persist_keypair;
-use service::{IdentityServiceServer, MyIdentityService};
+use service::{IdentityKeyserverServiceServer, MyIdentityService};
 
 #[derive(Parser)]
 #[clap(author, version, about, long_about = None)]
 #[clap(propagate_version = true)]
 struct Cli {
   #[clap(subcommand)]
   command: Commands,
 }
 
 #[derive(Subcommand)]
 enum Commands {
   /// Runs the server
   Server,
   /// Generates and persists a keypair to use for PAKE registration and login
   Keygen {
     #[clap(short, long)]
     #[clap(default_value_t = String::from(SECRETS_DIRECTORY))]
     dir: String,
   },
   /// Populates the `identity-users` table in DynamoDB from MySQL
   PopulateDB,
 }
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
   let subscriber = FmtSubscriber::new();
   tracing::subscriber::set_global_default(subscriber)?;
   let cli = Cli::parse();
   match &cli.command {
     Commands::Keygen { dir } => {
       generate_and_persist_keypair(dir)?;
     }
     Commands::Server => {
       load_config();
       let addr = IDENTITY_SERVICE_SOCKET_ADDR.parse()?;
       let aws_config = aws_config::from_env().region("us-east-2").load().await;
       let database_client = DatabaseClient::new(&aws_config);
       let server = MyIdentityService::new(database_client);
-      let svc = IdentityServiceServer::with_interceptor(server, check_auth);
+      let svc =
+        IdentityKeyserverServiceServer::with_interceptor(server, check_auth);
       Server::builder().add_service(svc).serve(addr).await?;
     }
     Commands::PopulateDB => unimplemented!(),
   }
 
   Ok(())
 }
diff --git a/services/identity/src/service.rs b/services/identity/src/service.rs
index ee871226a..588b322b7 100644
--- a/services/identity/src/service.rs
+++ b/services/identity/src/service.rs
@@ -1,617 +1,617 @@
 use aws_sdk_dynamodb::output::GetItemOutput;
 use aws_sdk_dynamodb::Error as DynamoDBError;
 use chrono::Utc;
 use comm_opaque::Cipher;
 use constant_time_eq::constant_time_eq;
 use futures_core::Stream;
 use opaque_ke::{ServerLogin, ServerRegistration};
 use rand::rngs::OsRng;
 use rand::{CryptoRng, Rng};
 use siwe::Message;
 use std::collections::{HashMap, HashSet};
 use std::pin::Pin;
 use tokio::sync::mpsc;
 use tokio_stream::{wrappers::ReceiverStream, StreamExt};
 use tonic::{Request, Response, Status};
 use tracing::{error, info, instrument};
 
 use crate::constants::MPSC_CHANNEL_BUFFER_CAPACITY;
 use crate::database::{DatabaseClient, Error as DBError};
 use crate::nonce::generate_nonce_data;
 use crate::pake_grpc;
 use crate::token::{AccessTokenData, AuthType};
 
-pub use proto::identity_service_server::IdentityServiceServer;
+pub use proto::identity_keyserver_service_server::IdentityKeyserverServiceServer;
 use proto::{
   get_user_id_request::AuthType as ProtoAuthType,
-  identity_service_server::IdentityService,
+  identity_keyserver_service_server::IdentityKeyserverService,
   login_request::Data::PakeLoginRequest,
   login_request::Data::WalletLoginRequest,
   login_response::Data::PakeLoginResponse,
   login_response::Data::WalletLoginResponse,
   pake_login_request::Data::PakeCredentialFinalization,
   pake_login_request::Data::PakeCredentialRequestAndUserId,
   pake_login_response::Data::AccessToken,
   pake_login_response::Data::PakeCredentialResponse,
   registration_request::Data::PakeCredentialFinalization as PakeRegistrationCredentialFinalization,
   registration_request::Data::PakeRegistrationRequestAndUserId,
   registration_request::Data::PakeRegistrationUploadAndCredentialRequest,
   registration_response::Data::PakeLoginResponse as PakeRegistrationLoginResponse,
   registration_response::Data::PakeRegistrationResponse, CompareUsersRequest,
   CompareUsersResponse, DeleteUserRequest, DeleteUserResponse,
   GenerateNonceRequest, GenerateNonceResponse,
   GetSessionInitializationInfoRequest, GetSessionInitializationInfoResponse,
   GetUserIdRequest, GetUserIdResponse, LoginRequest, LoginResponse,
   PakeLoginRequest as PakeLoginRequestStruct,
   PakeLoginResponse as PakeLoginResponseStruct, RegistrationRequest,
   RegistrationResponse, SessionInitializationInfo, UpdateUserRequest,
   UpdateUserResponse, VerifyUserTokenRequest, VerifyUserTokenResponse,
   WalletLoginRequest as WalletLoginRequestStruct,
   WalletLoginResponse as WalletLoginResponseStruct,
 };
 
 mod proto {
-  tonic::include_proto!("identity");
+  tonic::include_proto!("identity.keyserver");
 }
 
 mod login;
 mod registration;
 mod update;
 
 #[derive(Debug)]
 enum PakeWorkflow {
   Registration,
   Login,
 }
 
 #[derive(derive_more::Constructor)]
 pub struct MyIdentityService {
   client: DatabaseClient,
 }
 
 #[tonic::async_trait]
-impl IdentityService for MyIdentityService {
+impl IdentityKeyserverService for MyIdentityService {
   type RegisterUserStream = Pin<
     Box<
       dyn Stream<Item = Result<RegistrationResponse, Status>> + Send + 'static,
     >,
   >;
 
   #[instrument(skip(self))]
   async fn register_user(
     &self,
     request: Request<tonic::Streaming<RegistrationRequest>>,
   ) -> Result<Response<Self::RegisterUserStream>, Status> {
     let mut in_stream = request.into_inner();
     let (tx, rx) = mpsc::channel(MPSC_CHANNEL_BUFFER_CAPACITY);
     let client = self.client.clone();
 
     tokio::spawn(async move {
       let first_message = in_stream.next().await;
       let mut registration_state = registration::handle_registration_request(
         first_message,
         &client,
         tx.clone(),
       )
       .await?;
       // ServerRegistration in opaque-ke v1.2 doesn't implement Clone, so we
       // have to take the value out of registration_state, replacing it with None
       let pake_state =
         if let Some(pake_state) = registration_state.pake_state.take() {
           pake_state
         } else {
           error!("registration_state is missing opaque-ke ServerRegistration");
           return Err(Status::failed_precondition("internal error"));
         };
       let second_message = in_stream.next().await;
       let server_login =
         registration::handle_registration_upload_and_credential_request(
           second_message,
           tx.clone(),
           &client,
           &registration_state,
           pake_state,
         )
         .await?;
       let third_message = in_stream.next().await;
       registration::handle_credential_finalization(
         third_message,
         tx,
         &client,
         &registration_state,
         server_login,
       )
       .await?;
       Ok(())
     });
 
     let out_stream = ReceiverStream::new(rx);
     Ok(Response::new(
       Box::pin(out_stream) as Self::RegisterUserStream
     ))
   }
 
   type LoginUserStream =
     Pin<Box<dyn Stream<Item = Result<LoginResponse, Status>> + Send + 'static>>;
 
   #[instrument(skip(self))]
   async fn login_user(
     &self,
     request: Request<tonic::Streaming<LoginRequest>>,
   ) -> Result<Response<Self::LoginUserStream>, Status> {
     let mut in_stream = request.into_inner();
     let (tx, rx) = mpsc::channel(MPSC_CHANNEL_BUFFER_CAPACITY);
     let client = self.client.clone();
 
     tokio::spawn(async move {
       let first_message = in_stream.next().await;
       let login_state =
         login::handle_login_request(first_message, tx.clone(), &client).await?;
 
       // login_state will be None if user is logging in with a wallet
       if let Some(state) = login_state {
         let second_message = in_stream.next().await;
         login::handle_credential_finalization(
           second_message,
           tx,
           &client,
           state,
         )
         .await?;
       }
       Ok::<(), Status>(())
     });
 
     let out_stream = ReceiverStream::new(rx);
     Ok(Response::new(Box::pin(out_stream) as Self::LoginUserStream))
   }
 
   #[instrument(skip(self))]
   async fn verify_user_token(
     &self,
     request: Request<VerifyUserTokenRequest>,
   ) -> Result<Response<VerifyUserTokenResponse>, Status> {
     info!("Received VerifyUserToken request: {:?}", request);
     let message = request.into_inner();
     let token_valid = match self
       .client
       .get_access_token_data(message.user_id, message.signing_public_key)
       .await
     {
       Ok(Some(access_token_data)) => constant_time_eq(
         access_token_data.access_token.as_bytes(),
         message.access_token.as_bytes(),
       ),
       Ok(None) => false,
       Err(e) => return Err(handle_db_error(e)),
     };
     let response = Response::new(VerifyUserTokenResponse { token_valid });
     info!("Sending VerifyUserToken response: {:?}", response);
     Ok(response)
   }
 
   #[instrument(skip(self))]
   async fn get_user_id(
     &self,
     request: Request<GetUserIdRequest>,
   ) -> Result<Response<GetUserIdResponse>, Status> {
     let message = request.into_inner();
     let auth_type = match ProtoAuthType::from_i32(message.auth_type) {
       Some(ProtoAuthType::Password) => AuthType::Password,
       Some(ProtoAuthType::Wallet) => AuthType::Wallet,
       None => {
         error!(
           "Unable to parse AuthType from message: {}",
           message.auth_type
         );
         return Err(Status::invalid_argument("invalid message"));
       }
     };
     let user_id = match self
       .client
       .get_user_id_from_user_info(message.user_info, auth_type)
       .await
     {
       Ok(Some(user_id)) => user_id,
       Ok(None) => return Err(Status::not_found("no user ID found")),
       Err(e) => return Err(handle_db_error(e)),
     };
     let response = Response::new(GetUserIdResponse { user_id });
     Ok(response)
   }
 
   #[instrument(skip(self))]
   async fn delete_user(
     &self,
     request: tonic::Request<DeleteUserRequest>,
   ) -> Result<tonic::Response<DeleteUserResponse>, tonic::Status> {
     let message = request.into_inner();
     match self.client.delete_user(message.user_id).await {
       Ok(_) => Ok(Response::new(DeleteUserResponse {})),
       Err(e) => Err(handle_db_error(e)),
     }
   }
 
   #[instrument(skip(self))]
   async fn compare_users(
     &self,
     request: Request<CompareUsersRequest>,
   ) -> Result<Response<CompareUsersResponse>, Status> {
     let message = request.into_inner();
     let mut mysql_users_vec = message.users;
     let mut ddb_users_vec = match self.client.get_users().await {
       Ok(user_list) => user_list,
       Err(e) => return Err(handle_db_error(e)),
     };
     // We use HashSets here for faster lookups
     let mysql_users_set = HashSet::<String>::from_iter(mysql_users_vec.clone());
     let ddb_users_set = HashSet::<String>::from_iter(ddb_users_vec.clone());
 
     ddb_users_vec.retain(|user| !mysql_users_set.contains(user));
     mysql_users_vec.retain(|user| !ddb_users_set.contains(user));
     Ok(Response::new(CompareUsersResponse {
       users_missing_from_keyserver: ddb_users_vec,
       users_missing_from_identity: mysql_users_vec,
     }))
   }
 
   #[instrument(skip(self))]
   async fn generate_nonce(
     &self,
     _request: Request<GenerateNonceRequest>,
   ) -> Result<Response<GenerateNonceResponse>, Status> {
     let nonce_data = generate_nonce_data(&mut OsRng);
     match self
       .client
       .add_nonce_to_nonces_table(nonce_data.clone())
       .await
     {
       Ok(_) => Ok(Response::new(GenerateNonceResponse {
         nonce: nonce_data.nonce,
       })),
       Err(e) => Err(handle_db_error(e)),
     }
   }
 
   #[instrument(skip(self))]
   async fn get_session_initialization_info(
     &self,
     request: Request<GetSessionInitializationInfoRequest>,
   ) -> Result<Response<GetSessionInitializationInfoResponse>, Status> {
     let message = request.into_inner();
     match self
       .client
       .get_session_initialization_info(&message.user_id)
       .await
     {
       Ok(Some(session_initialization_info)) => {
         let mut devices = HashMap::new();
         for (device, info) in session_initialization_info {
           devices.insert(device, SessionInitializationInfo { info });
         }
         Ok(Response::new(GetSessionInitializationInfoResponse {
           devices,
         }))
       }
       Ok(None) => return Err(Status::not_found("user not found")),
       Err(e) => Err(handle_db_error(e)),
     }
   }
 
   #[instrument(skip(self))]
   async fn update_user(
     &self,
     request: Request<tonic::Streaming<UpdateUserRequest>>,
   ) -> Result<Response<Self::UpdateUserStream>, Status> {
     let (tx, rx) = mpsc::channel(MPSC_CHANNEL_BUFFER_CAPACITY);
     let db_client = self.client.clone();
 
     tokio::spawn(async move {
       update::handle_server_update_user_messages(
         request.into_inner(),
         db_client,
         tx,
       )
       .await;
     });
 
     let out_stream = ReceiverStream::new(rx);
 
     Ok(Response::new(Box::pin(out_stream) as Self::UpdateUserStream))
   }
 
   type UpdateUserStream = Pin<
     Box<dyn Stream<Item = Result<UpdateUserResponse, Status>> + Send + 'static>,
   >;
 }
 
 async fn put_token_helper(
   client: &DatabaseClient,
   auth_type: AuthType,
   user_id: &str,
   signing_public_key: &str,
   rng: &mut (impl Rng + CryptoRng),
 ) -> Result<String, Status> {
   if user_id.is_empty() || signing_public_key.is_empty() {
     error!(
       "Incomplete data: user ID \"{}\", signing public key \"{}\"",
       user_id, signing_public_key
     );
     return Err(Status::aborted("user not found"));
   }
   let access_token_data = AccessTokenData::new(
     user_id.to_string(),
     signing_public_key.to_string(),
     auth_type,
     rng,
   );
   match client
     .put_access_token_data(access_token_data.clone())
     .await
   {
     Ok(_) => Ok(access_token_data.access_token),
     Err(e) => Err(handle_db_error(e)),
   }
 }
 
 fn parse_and_verify_siwe_message(
   user_id: &str,
   signing_public_key: &str,
   siwe_message: &str,
   siwe_signature: &str,
 ) -> Result<(), Status> {
   if user_id.is_empty() || signing_public_key.is_empty() {
     error!(
       "Incomplete data: user ID {}, signing public key {}",
       user_id, signing_public_key
     );
     return Err(Status::aborted("user not found"));
   }
   let siwe_message: Message = match siwe_message.parse() {
     Ok(m) => m,
     Err(e) => {
       error!("Failed to parse SIWE message: {}", e);
       return Err(Status::invalid_argument("invalid message"));
     }
   };
 
   let decoded_signature = hex::decode(siwe_signature.trim_start_matches("0x"))
     .map_err(|e| {
       error!("Failed to decode SIWE signature: {}", e);
       Status::invalid_argument("invalid signature")
     })?;
 
   match siwe_message.verify(
     match decoded_signature.try_into() {
       Ok(s) => s,
       Err(e) => {
         error!("Conversion to SIWE signature failed: {:?}", e);
         return Err(Status::invalid_argument("invalid message"));
       }
     },
     None,
     None,
     Some(&Utc::now()),
   ) {
     Err(e) => {
       error!(
         "Signature verification failed for user {} with signing public key {}: {}",
         user_id, signing_public_key, e
       );
       Err(Status::unauthenticated("message not authenticated"))
     }
     Ok(_) => Ok(()),
   }
 }
 
 async fn wallet_login_helper(
   client: &DatabaseClient,
   wallet_login_request: WalletLoginRequestStruct,
   rng: &mut (impl Rng + CryptoRng),
 ) -> Result<LoginResponse, Status> {
   parse_and_verify_siwe_message(
     &wallet_login_request.user_id,
     &wallet_login_request.signing_public_key,
     &wallet_login_request.siwe_message,
     &wallet_login_request.siwe_signature,
   )?;
   client
     .update_users_table(
       wallet_login_request.user_id.clone(),
       Some(wallet_login_request.signing_public_key.clone()),
       None,
       None,
       Some(
         &wallet_login_request
           .session_initialization_info
           .ok_or_else(|| Status::invalid_argument("Invalid message"))?
           .info,
       ),
     )
     .await
     .map_err(handle_db_error)?;
   Ok(LoginResponse {
     data: Some(WalletLoginResponse(WalletLoginResponseStruct {
       access_token: put_token_helper(
         client,
         AuthType::Wallet,
         &wallet_login_request.user_id,
         &wallet_login_request.signing_public_key,
         rng,
       )
       .await?,
     })),
   })
 }
 
 async fn pake_login_start(
   client: &DatabaseClient,
   user_id: &str,
   pake_credential_request: &[u8],
 ) -> Result<LoginResponseAndPakeState, Status> {
   if user_id.is_empty() {
     error!("Incomplete data: user ID not provided");
     return Err(Status::aborted("user not found"));
   }
   let server_registration =
     match client.get_pake_registration(user_id.to_string()).await {
       Ok(Some(r)) => r,
       Ok(None) => {
         return Err(Status::not_found("user not found"));
       }
       Err(e) => return Err(handle_db_error(e)),
     };
   let server_login_start_result = pake_grpc::server_login_start(
     &mut OsRng,
     server_registration,
     pake_credential_request,
   )?;
   let credential_response =
     server_login_start_result.message.serialize().map_err(|e| {
       error!("Failed to serialize PAKE message: {}", e);
       Status::failed_precondition("internal error")
     })?;
   Ok(LoginResponseAndPakeState {
     response: PakeLoginResponseStruct {
       data: Some(PakeCredentialResponse(credential_response)),
     },
     pake_state: server_login_start_result.state,
   })
 }
 
 async fn pake_login_finish(
   user_id: &str,
   signing_public_key: &str,
   client: &DatabaseClient,
   server_login: ServerLogin<Cipher>,
   pake_credential_finalization: &Vec<u8>,
   rng: &mut (impl Rng + CryptoRng),
   pake_workflow: PakeWorkflow,
   session_initialization_info: &HashMap<String, String>,
 ) -> Result<PakeLoginResponseStruct, Status> {
   if user_id.is_empty() || signing_public_key.is_empty() {
     error!(
       "Incomplete data: user ID {}, signing public key {}",
       user_id, signing_public_key
     );
     return Err(Status::aborted("user not found"));
   }
 
   pake_grpc::server_login_finish(server_login, pake_credential_finalization)?;
   if matches!(pake_workflow, PakeWorkflow::Login) {
     client
       .update_users_table(
         user_id.to_string(),
         Some(signing_public_key.to_string()),
         None,
         None,
         Some(session_initialization_info),
       )
       .await
       .map_err(handle_db_error)?;
   }
   Ok(PakeLoginResponseStruct {
     data: Some(AccessToken(
       put_token_helper(
         client,
         AuthType::Password,
         user_id,
         signing_public_key,
         rng,
       )
       .await?,
     )),
   })
 }
 
 async fn server_register_response(
   registration_request_bytes: &Vec<u8>,
 ) -> Result<RegistrationResponseAndPakeState, Status> {
   let server_registration_start_result = pake_grpc::server_registration_start(
     &mut OsRng,
     registration_request_bytes,
   )?;
   Ok(RegistrationResponseAndPakeState {
     response: RegistrationResponse {
       data: Some(PakeRegistrationResponse(
         server_registration_start_result.message.serialize(),
       )),
     },
     pake_state: server_registration_start_result.state,
   })
 }
 
 async fn pake_registration_finish(
   user_id: &str,
   client: &DatabaseClient,
   registration_upload_bytes: &Vec<u8>,
   server_registration: ServerRegistration<Cipher>,
   username: &str,
   signing_public_key: &str,
   session_initialization_info: &HashMap<String, String>,
 ) -> Result<(), Status> {
   if user_id.is_empty() {
     error!("Incomplete data: user ID not provided");
     return Err(Status::aborted("user not found"));
   }
   let server_registration_finish_result =
     pake_grpc::server_registration_finish(
       server_registration,
       registration_upload_bytes,
     )?;
 
   match client
     .add_user_to_users_table(
       user_id.to_string(),
       server_registration_finish_result,
       username.to_string(),
       signing_public_key.to_string(),
       session_initialization_info,
     )
     .await
   {
     Ok(_) => Ok(()),
     Err(e) => Err(handle_db_error(e)),
   }
 }
 
 fn handle_db_error(db_error: DBError) -> Status {
   match db_error {
     DBError::AwsSdk(DynamoDBError::InternalServerError(_))
     | DBError::AwsSdk(DynamoDBError::ProvisionedThroughputExceededException(
       _,
     ))
     | DBError::AwsSdk(DynamoDBError::RequestLimitExceeded(_)) => {
       Status::unavailable("please retry")
     }
     e => {
       error!("Encountered an unexpected error: {}", e);
       Status::failed_precondition("unexpected error")
     }
   }
 }
 
 struct RegistrationResponseAndPakeState {
   response: RegistrationResponse,
   pake_state: ServerRegistration<Cipher>,
 }
 
 struct LoginResponseAndPakeState {
   response: PakeLoginResponseStruct,
   pake_state: ServerLogin<Cipher>,
 }
 
 async fn send_to_client<T>(
   tx: &tokio::sync::mpsc::Sender<Result<T, Status>>,
   response: Result<T, Status>,
 ) -> Result<(), Status> {
   let transport_result = match response {
     Ok(message) => tx.send(Ok(message)).await,
     Err(status) => {
       error!("{}", status.message());
       tx.send(Err(status)).await
     }
   };
 
   transport_result.map_err(|_| Status::internal("disconnection"))
 }
diff --git a/shared/protos/identity.proto b/shared/protos/identity.proto
index 189b6c817..80e784949 100644
--- a/shared/protos/identity.proto
+++ b/shared/protos/identity.proto
@@ -1,238 +1,238 @@
 syntax = "proto3";
 
-package identity;
+package identity.keyserver;
 
-service IdentityService {
+service IdentityKeyserverService {
   // Called by user to register with the Identity Service (PAKE only)
   rpc RegisterUser(stream RegistrationRequest) returns (stream
     RegistrationResponse) {}
   // Called by user to create an active session and get an access token
   rpc LoginUser(stream LoginRequest) returns (stream LoginResponse) {}
   // Called by other services to verify a user's token
   rpc VerifyUserToken(VerifyUserTokenRequest) returns (VerifyUserTokenResponse)
     {}
   // Called by users and keyservers to get userID corresponding to a wallet
   // address or username
   rpc GetUserID(GetUserIDRequest) returns (GetUserIDResponse) {}
 
   rpc DeleteUser(DeleteUserRequest) returns (DeleteUserResponse) {}
   // Called by Ashoat's keyserver with a list of user IDs in MySQL and returns:
   // 1. a list of user IDs that are in DynamoDB but not in the supplied list
   // 2. a list of user IDs that are in the supplied list but not in DynamoDB
   rpc CompareUsers(CompareUsersRequest) returns (CompareUsersResponse) {}
   // Called by clients to get a nonce for a Sign-In with Ethereum message
   rpc GenerateNonce(GenerateNonceRequest) returns (GenerateNonceResponse) {}
   // Called by clients to get session initialization info needed to open a new
   // channel of communication with a given user
   rpc GetSessionInitializationInfo(GetSessionInitializationInfoRequest) returns
     (GetSessionInitializationInfoResponse) {}
 
   rpc UpdateUser(stream UpdateUserRequest) returns
     (stream UpdateUserResponse) {}
 }
 
 // Helper types
 
 message PakeRegistrationRequestAndUserID {
   string userID = 1;
   // ed25519 key for the given user's device
   string signingPublicKey = 2;
   // Message sent to initiate PAKE registration (step 1)
   bytes pakeRegistrationRequest = 3;
   string username = 4;
   // Information specific to a user's device needed to open a new channel of
   // communication with this user
   SessionInitializationInfo sessionInitializationInfo = 5;
 }
 
 message PakeCredentialRequestAndUserID {
   string userID = 1;
   // ed25519 key for the given user's device
   string signingPublicKey = 2;
   // Message sent to initiate PAKE login (step 1)
   bytes pakeCredentialRequest = 3;
   // Information specific to a user's device needed to open a new channel of
   // communication with this user
   SessionInitializationInfo sessionInitializationInfo = 4;
 }
 
 message PakeLoginRequest {
   oneof data {
     PakeCredentialRequestAndUserID pakeCredentialRequestAndUserID = 1;
     // Final message in PAKE login (step 3)
     bytes pakeCredentialFinalization = 2;
   }
 }
 
 message PakeLoginResponse {
   oneof data {
     // Answer sent to the user upon reception of the PAKE login attempt,
     // containing a sealed envelope with the user's private key (step 2)
     bytes pakeCredentialResponse = 1;
     string accessToken = 2;
   }
 }
 
 message PakeRegistrationUploadAndCredentialRequest {
   // Final message in PAKE registration, containing sealed cryptographic
   // identifiers (step 3)
   bytes pakeRegistrationUpload = 1;
   // Message sent to initiate PAKE login (Same as in
   // PakeCredentialRequestAndUserID) (step 1)
   bytes pakeCredentialRequest = 2;
 }
 
 message WalletLoginRequest {
   string userID = 1;
   // ed25519 key for the given user's device
   string signingPublicKey = 2;
   string siweMessage = 3;
   string siweSignature = 4;
   // Information specific to a user's device needed to open a new channel of
   // communication with this user
   SessionInitializationInfo sessionInitializationInfo = 5;
 }
 
 message WalletLoginResponse {
   string accessToken = 1;
 }
 
 message SessionInitializationInfo {
   // Initially, the key-value pairs will be as follows:
   // payload -> stringified JSON containing primary and notification public keys
   // signature -> above payload signed with the signing ed25519 key
   // socialProof -> a signed message used for SIWE (optional)
   map<string, string> info = 1;
 }
 
 // RegisterUser
 
 message RegistrationRequest {
   oneof data {
     PakeRegistrationRequestAndUserID pakeRegistrationRequestAndUserID = 1;
     // We combine the last step of PAKE registration with the first step of PAKE
     // login here to reduce the number of messages sent
     PakeRegistrationUploadAndCredentialRequest
       pakeRegistrationUploadAndCredentialRequest = 2;
     // Final message in PAKE login (Same as in PakeLoginRequest) (step 3)
     bytes pakeCredentialFinalization = 3;
   }
 }
 
 message RegistrationResponse {
   oneof data {
     // Answer sent to the user upon reception of the PAKE registration attempt
     // (step 2)
     bytes pakeRegistrationResponse = 1;
     PakeLoginResponse pakeLoginResponse = 2;
   }
 }
 
 // LoginUser
 
 message LoginRequest {
   oneof data {
     PakeLoginRequest pakeLoginRequest = 1;
     WalletLoginRequest walletLoginRequest = 2;
   }
 }
 
 message LoginResponse {
   oneof data {
     PakeLoginResponse pakeLoginResponse = 1;
     WalletLoginResponse walletLoginResponse = 2;
   }
 }
 
 // VerifyUserToken
 
 message VerifyUserTokenRequest {
   string userID = 1;
   // ed25519 key for the given user's device
   string signingPublicKey = 2;
   string accessToken = 3;
 }
 
 message VerifyUserTokenResponse {
   bool tokenValid = 1;
 }
 
 // GetUserID
 
 message GetUserIDRequest {
   enum AuthType {
     PASSWORD = 0;
     WALLET = 1;
   }
   AuthType authType = 1;
   string userInfo = 2;
 }
 
 message GetUserIDResponse {
   string userID = 1;
 }
 
 // DeleteUser
 
 message DeleteUserRequest {
   string userID = 1;
 }
 
 // Need to respond with a message to show success, an
 // empty reponse should work just fine
 message DeleteUserResponse {}
 
 // CompareUsers
 
 message CompareUsersRequest {
   repeated string users = 1;
 }
 
 message CompareUsersResponse {
   repeated string usersMissingFromKeyserver = 1;
   repeated string usersMissingFromIdentity = 2;
 }
 
 // GenerateNonce
 
 message GenerateNonceRequest {
 }
 
 message GenerateNonceResponse{
   string nonce = 1;
 }
 
 // GetSessionInitializationInfo
 
 message GetSessionInitializationInfoRequest {
   string userID = 1;
 }
 
 message GetSessionInitializationInfoResponse {
   // Map is keyed on devices' public ed25519 key used for signing
   map<string, SessionInitializationInfo> devices = 1;
 }
 
 // UpdateUser
 
 // Messages sent from a client to Identity Service
 message UpdateUserRequest {
   oneof data {
     // Only need user information on initial call, subsequent PAKE commands
     // can infer parameters from first Request + userID
     PakeRegistrationRequestAndUserID request = 1;
     // We combine the last step of PAKE registration with the first step of PAKE
     // login here to reduce the number of messages sent
     PakeRegistrationUploadAndCredentialRequest
       pakeRegistrationUploadAndCredentialRequest = 2;
     bytes pakeLoginFinalizationMessage = 4;
   }
 }
 
 // Messages sent from Identity Service to a client
 message UpdateUserResponse {
   oneof data {
     bytes pakeRegistrationResponse = 1;
     PakeLoginResponse pakeLoginResponse = 2;
   }
 }