diff --git a/lib/tempest/accounts.ex b/lib/tempest/accounts.ex
index 6d21fd4..7b97c14 100644
--- a/lib/tempest/accounts.ex
+++ b/lib/tempest/accounts.ex
@@ -8,6 +8,7 @@ defmodule Tempest.Accounts do
   alias Tempest.Accounts.{Account, AppPasswords, AuthContext, Password, Session, Tokens}
   alias Tempest.Identity
   alias Tempest.Identity.KeyStore
+  alias Tempest.Identity.Multikey
   alias Tempest.RepoCore.{CarVerifier, Drisl}
   alias Tempest.{Repo, RepoStorage, Security, Sequencer}
 
@@ -630,7 +631,7 @@ defmodule Tempest.Accounts do
   defp signing_key_response(account, key) do
     %{
       "did" => account.did,
-      "signingKey" => key.public_key_multibase,
+      "signingKey" => Multikey.encode_secp256k1_did_key!(key.public_key_multibase),
       "verificationMethod" => account.did <> key.kid
     }
   end
diff --git a/lib/tempest/identity/did_document.ex b/lib/tempest/identity/did_document.ex
index b455796..6381ca5 100644
--- a/lib/tempest/identity/did_document.ex
+++ b/lib/tempest/identity/did_document.ex
@@ -4,7 +4,7 @@ defmodule Tempest.Identity.DidDocument do
   """
 
   alias Tempest.Accounts.Account
-  alias Tempest.Identity.KeyStore
+  alias Tempest.Identity.{KeyStore, Multikey}
 
   def build(%Account{} = account) do
     signing_key = KeyStore.active_key_for_account(account)
@@ -19,7 +19,7 @@ defmodule Tempest.Identity.DidDocument do
           "id" => verification_id,
           "type" => "Multikey",
           "controller" => account.did,
-          "publicKeyMultibase" => signing_key.public_key_multibase
+          "publicKeyMultibase" => Multikey.encode_secp256k1_public_key!(signing_key.public_key_multibase)
         }
       ],
       "service" => [
diff --git a/lib/tempest/identity/multikey.ex b/lib/tempest/identity/multikey.ex
index e620971..f07c6d3 100644
--- a/lib/tempest/identity/multikey.ex
+++ b/lib/tempest/identity/multikey.ex
@@ -27,6 +27,13 @@ defmodule Tempest.Identity.Multikey do
     end
   end
 
+  def encode_secp256k1_public_key!(public_key) do
+    case encode_secp256k1_public_key(public_key) do
+      {:ok, multikey} -> multikey
+      {:error, reason} -> raise ArgumentError, "invalid secp256k1 public key: #{inspect(reason)}"
+    end
+  end
+
   def decode_secp256k1_public_key(multibase, opts \\ [])
 
   def decode_secp256k1_public_key(multibase, opts) when is_binary(multibase) do
diff --git a/test/tempest_web/xrpc/accounts_sessions_test.exs b/test/tempest_web/xrpc/accounts_sessions_test.exs
index db5f1a7..5e847b3 100644
--- a/test/tempest_web/xrpc/accounts_sessions_test.exs
+++ b/test/tempest_web/xrpc/accounts_sessions_test.exs
@@ -185,6 +185,7 @@ defmodule TempestWeb.Xrpc.AccountsSessionsTest do
     assert first["did"] == account["did"]
     assert first["verificationMethod"] == account["did"] <> "#atproto"
     assert first["signingKey"] == second["signingKey"]
+    assert String.starts_with?(first["signingKey"], "did:key:z")
   end
 
   test "createAccount with an existing DID requires service auth and starts deactivated", %{conn: conn} do
diff --git a/test/tempest_web/xrpc/identity_handles_test.exs b/test/tempest_web/xrpc/identity_handles_test.exs
index d2c8cec..31dd820 100644
--- a/test/tempest_web/xrpc/identity_handles_test.exs
+++ b/test/tempest_web/xrpc/identity_handles_test.exs
@@ -51,7 +51,7 @@ defmodule TempestWeb.Xrpc.IdentityHandlesTest do
 
     assert document["id"] == account["did"]
     assert DidDocument.claims_handle?(document, "brigid.test")
-    assert [%{"type" => "Multikey", "publicKeyMultibase" => "u" <> _public_key}] = document["verificationMethod"]
+    assert [%{"type" => "Multikey", "publicKeyMultibase" => "z" <> _public_key}] = document["verificationMethod"]
 
     assert [%{"type" => "AtprotoPersonalDataServer", "serviceEndpoint" => "http://localhost:4002"}] =
              document["service"]