According to the [spec] section 4.2, "rsa" and "ecdsa" keys, as defined by: ``` { "keytype" : "rsa", "scheme" : "rsassa-pss-sha256", "keyval" : {"public" : PUBLIC} } { "keytype" : "ecdsa-sha2-nistp256", "scheme" : "ecdsa-sha2-nistp256", "keyval" : {"public" : PUBLIC} } ``` The public portion of the key should be encoded as a PEM string, not `base64(spki(key))`. [spec]: https://github.com/theupdateframework/specification/blob/master/tuf-spec.md