diff --git a/dev/Stores/User/OpenPGP.js b/dev/Stores/User/OpenPGP.js
index 5863dddef..59ea3ae0e 100644
--- a/dev/Stores/User/OpenPGP.js
+++ b/dev/Stores/User/OpenPGP.js
@@ -131,8 +131,6 @@ export const OpenPGPUserStore = new class {
 		keyPair.privateKey
 		keyPair.publicKey
 		keyPair.revocationCertificate
-		keyPair.onServer
-		keyPair.inGnuPG
 	 */
 	storeKeyPair(keyPair) {
 		openpgp.readKey({armoredKey:keyPair.publicKey}).then(key => {
@@ -164,6 +162,8 @@ export const OpenPGPUserStore = new class {
 		return findOpenPGPKey(this.publicKeys, query/*, sign*/);
 	}
 
+	decrypt(text, fCallback)
+	{
 /*
 	decryptMessage(message, recipients, fCallback) {
 		message = store.openpgp.message.readArmored(armoredMessage);
@@ -229,11 +229,18 @@ export const OpenPGPUserStore = new class {
 
 		fCallback(null, null);
 
-		return false;
-	}
 */
+	}
 
-	verifyMessage(message, fCallback) {
+	verify(message, fCallback) {
+		let text = null;
+		try {
+			// TODO: if message.pgpSigned().SigPartId then fetch raw from server
+			text = openpgp.cleartext.readArmored(message.plain);
+		} catch (e) {
+			console.error(e);
+		}
+		if (text && text.getText && text.verify) {
 		if (message && message.getSigningKeyIds) {
 			const signingKeyIds = message.getSigningKeyIds();
 			if (signingKeyIds && signingKeyIds.length) {
diff --git a/dev/Stores/User/Pgp.js b/dev/Stores/User/Pgp.js
index 8b9068f09..587eca9f4 100644
--- a/dev/Stores/User/Pgp.js
+++ b/dev/Stores/User/Pgp.js
@@ -67,19 +67,6 @@ export const PgpUserStore = new class {
 		return !!(OpenPGPUserStore.isSupported() || GnuPGUserStore.isSupported() || window.mailvelope);
 	}
 
-	/**
-		keyPair.privateKey
-		keyPair.publicKey
-		keyPair.revocationCertificate
-		keyPair.onServer
-		keyPair.inGnuPG
-	 */
-	storeKeyPair(keyPair, callback) {
-		OpenPGPUserStore.isSupported() && OpenPGPUserStore.storeKeyPair(keyPair);
-//		if (Settings.capa(Capa.GnuPG)) {
-		GnuPGUserStore.storeKeyPair(keyPair, callback);
-	}
-
 	/**
 	 * Checks if verifying/encrypting a message is possible with given email addresses.
 	 * Returns the first library that can.
diff --git a/dev/View/Popup/OpenPgpGenerate.js b/dev/View/Popup/OpenPgpGenerate.js
index fa3a7b2e5..35dee3c80 100644
--- a/dev/View/Popup/OpenPgpGenerate.js
+++ b/dev/View/Popup/OpenPgpGenerate.js
@@ -1,6 +1,8 @@
 //import { pInt } from 'Common/Utils';
 
-import { PgpUserStore } from 'Stores/User/Pgp';
+import { GnuPGUserStore } from 'Stores/User/GnuPG';
+import { OpenPGPUserStore } from 'Stores/User/OpenPGP';
+
 import { IdentityUserStore } from 'Stores/User/Identity';
 
 import { AbstractViewPopup } from 'Knoin/AbstractViews';
@@ -25,8 +27,11 @@ export class OpenPgpGeneratePopupView extends AbstractViewPopup {
 			submitRequest: false,
 			submitError: '',
 
-			saveGnuPG: true,
-			saveServer: true
+			backupPublicKey: true,
+			backupPrivateKey: false,
+
+			saveGnuPGPublic: true,
+			saveGnuPGPrivate: false
 		});
 
 		this.canGnuPG = Settings.capa(Capa.GnuPG);
@@ -63,12 +68,23 @@ export class OpenPgpGeneratePopupView extends AbstractViewPopup {
 
 		openpgp.generateKey(cfg).then(keyPair => {
 			if (keyPair) {
-				keyPair.onServer = this.saveServer() ? 1 : 0;
-				keyPair.inGnuPG = this.saveGnuPG() ? 1 : 0;
-				PgpUserStore.storeKeyPair(keyPair, ()=>{
+				const fn = () => {
 					this.submitRequest(false);
 					this.cancelCommand();
-				});
+				};
+
+				OpenPGPUserStore.storeKeyPair(keyPair);
+
+				keyPair.onServer = (this.backupPublicKey() ? 1 : 0) + (this.backupPrivateKey() ? 2 : 0);
+				keyPair.inGnuPG = (this.saveGnuPGPublic() ? 1 : 0) + (this.saveGnuPGPrivate() ? 2 : 0);
+				if (keyPair.onServer || keyPair.inGnuPG) {
+					if (!this.backupPrivateKey() && !this.saveGnuPGPrivate()) {
+						delete keyPair.privateKey;
+					}
+					GnuPGUserStore.storeKeyPair(keyPair, fn);
+				} else {
+					fn();
+				}
 			}
 		})
 		.catch((e) => {
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Pgp.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Pgp.php
index 8924d4e05..e2808274a 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Pgp.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Pgp.php
@@ -214,30 +214,34 @@ trait Pgp
 	 */
 	public function DoPgpStoreKeyPair() : array
 	{
+		$publicKey  = $this->GetActionParam('publicKey', '');
+		$privateKey = $this->GetActionParam('privateKey', '');
+
 		$result = [
 			'onServer' => [false, false, false],
 			'inGnuPG'  => [false, false, false]
 		];
-		$publicKey  = $this->GetActionParam('publicKey', '');
-		$privateKey = $this->GetActionParam('privateKey', '');
-		$revocationCertificate = $this->GetActionParam('revocationCertificate', '');
-		if ($this->GetActionParam('onServer', '')) {
-			$result['onServer'] = [
-				$this->StorePGPKey($publicKey),
-				$this->StorePGPKey($privateKey),
-				false // $this->StorePGPKey($revocationCertificate)
-			];
+
+		$onServer = (int) $this->GetActionParam('onServer', 0);
+		if ($publicKey && $onServer & 1) {
+			$result['onServer'][0] = $this->StorePGPKey($publicKey);
 		}
-		if ($this->GetActionParam('inGnuPG', '')) {
+		if ($privateKey && $onServer & 2) {
+			$result['onServer'][1] = $this->StorePGPKey($privateKey);
+		}
+
+		$inGnuPG = (int) $this->GetActionParam('inGnuPG', 0);
+		if ($inGnuPG) {
 			$GPG = $this->GnuPG();
-			if ($GPG) {
-				$result['inGnuPG'] = [
-					$publicKey  && $GPG->import($publicKey),
-					$privateKey && $GPG->import($privateKey),
-					false // $revocationCertificate && $GPG->import($revocationCertificate)
-				];
+			if ($publicKey && $inGnuPG & 1) {
+				$result['inGnuPG'][0] = $GPG->import($publicKey);
+			}
+			if ($privateKey && $inGnuPG & 2) {
+				$result['inGnuPG'][1] = $GPG->import($privateKey);
 			}
 		}
+
+//		$revocationCertificate = $this->GetActionParam('revocationCertificate', '');
 		return $this->DefaultResponse(__FUNCTION__, $result);
 	}
 
diff --git a/snappymail/v/0.0.0/app/templates/Views/User/PopupsOpenPgpGenerate.html b/snappymail/v/0.0.0/app/templates/Views/User/PopupsOpenPgpGenerate.html
index 496a4df2b..9c552c90b 100644
--- a/snappymail/v/0.0.0/app/templates/Views/User/PopupsOpenPgpGenerate.html
+++ b/snappymail/v/0.0.0/app/templates/Views/User/PopupsOpenPgpGenerate.html
@@ -40,16 +40,32 @@
 		<div data-bind="component: {
 			name: 'Checkbox',
 			params: {
-				label: 'Store (encrypted) on server',
-				value: saveServer
+				label: 'Store public key on server',
+				value: backupPublicKey
+			}
+		}"></div>
+		<br/>
+		<div data-bind="component: {
+			name: 'Checkbox',
+			params: {
+				label: 'Backup private key on server',
+				value: backupPrivateKey
 			}
 		}"></div>
 		<br/>
 		<div data-bind="visible: canGnuPG, component: {
 			name: 'Checkbox',
 			params: {
-				label: 'Store on server in GnuPG',
-				value: saveGnuPG
+				label: 'Store public key on server in GnuPG',
+				value: saveGnuPGPublic
+			}
+		}"></div>
+		<br/>
+		<div data-bind="visible: canGnuPG, component: {
+			name: 'Checkbox',
+			params: {
+				label: 'Store private key on server in GnuPG',
+				value: saveGnuPGPrivate
 			}
 		}"></div>
 	</div>