diff --git a/src/builder.rs b/src/builder.rs
index aaf1538..074e17d 100644
--- a/src/builder.rs
+++ b/src/builder.rs
@@ -9,9 +9,9 @@ use yubikey_piv::{
 
 use crate::{
     error::Error,
+    key::{self, Stub},
     p256::Recipient,
     util::{Metadata, POLICY_EXTENSION_OID},
-    yubikey::{self, Stub},
     BINARY_NAME, USABLE_SLOTS,
 };
 
@@ -90,7 +90,7 @@ impl IdentityBuilder {
         // No need to ask for users to enter their PIN if the PIN policy requires it,
         // because here we _always_ require them to enter their PIN in order to access the
         // protected management key (which is necessary in order to generate identities).
-        yubikey::manage(yubikey)?;
+        key::manage(yubikey)?;
 
         if let TouchPolicy::Never = touch_policy {
             // No need to touch YubiKey
diff --git a/src/yubikey.rs b/src/key.rs
similarity index 100%
rename from src/yubikey.rs
rename to src/key.rs
diff --git a/src/main.rs b/src/main.rs
index d2ed3be..5d21025 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -15,10 +15,10 @@ use yubikey_piv::{
 mod builder;
 mod error;
 mod format;
+mod key;
 mod p256;
 mod plugin;
 mod util;
-mod yubikey;
 
 use error::Error;
 
@@ -148,7 +148,7 @@ impl TryFrom<PluginOptions> for PluginFlags {
 }
 
 fn generate(flags: PluginFlags) -> Result<(), Error> {
-    let mut yubikey = yubikey::open(flags.serial)?;
+    let mut yubikey = key::open(flags.serial)?;
 
     let (stub, recipient, metadata) = builder::IdentityBuilder::new(flags.slot)
         .with_name(flags.name)
@@ -165,9 +165,9 @@ fn generate(flags: PluginFlags) -> Result<(), Error> {
 fn print_single(
     serial: Option<Serial>,
     slot: RetiredSlotId,
-    printer: impl Fn(yubikey::Stub, p256::Recipient, util::Metadata),
+    printer: impl Fn(key::Stub, p256::Recipient, util::Metadata),
 ) -> Result<(), Error> {
-    let mut yubikey = yubikey::open(serial)?;
+    let mut yubikey = key::open(serial)?;
 
     let mut keys = Key::list(&mut yubikey)?.into_iter().filter_map(|key| {
         // - We only use the retired slots.
@@ -184,7 +184,7 @@ fn print_single(
         .find(|(_, s, _)| s == &slot)
         .ok_or(Error::SlotHasNoIdentity(slot))?;
 
-    let stub = yubikey::Stub::new(yubikey.serial(), slot, &recipient);
+    let stub = key::Stub::new(yubikey.serial(), slot, &recipient);
     let metadata = x509_parser::parse_x509_certificate(key.certificate().as_ref())
         .ok()
         .and_then(|(_, cert)| util::Metadata::extract(&mut yubikey, slot, &cert, true))
@@ -199,12 +199,12 @@ fn print_multiple(
     kind: &str,
     serial: Option<Serial>,
     all: bool,
-    printer: impl Fn(yubikey::Stub, p256::Recipient, util::Metadata),
+    printer: impl Fn(key::Stub, p256::Recipient, util::Metadata),
 ) -> Result<(), Error> {
     let mut readers = Readers::open()?;
 
     let mut printed = 0;
-    for reader in readers.iter()?.filter(yubikey::filter_connected) {
+    for reader in readers.iter()?.filter(key::filter_connected) {
         let mut yubikey = reader.open()?;
         if let Some(serial) = serial {
             if yubikey.serial() != serial {
@@ -228,7 +228,7 @@ fn print_multiple(
                 _ => continue,
             };
 
-            let stub = yubikey::Stub::new(yubikey.serial(), slot, &recipient);
+            let stub = key::Stub::new(yubikey.serial(), slot, &recipient);
             let metadata = match x509_parser::parse_x509_certificate(key.certificate().as_ref())
                 .ok()
                 .and_then(|(_, cert)| util::Metadata::extract(&mut yubikey, slot, &cert, all))
@@ -257,7 +257,7 @@ fn print_details(
     kind: &str,
     flags: PluginFlags,
     all: bool,
-    printer: impl Fn(yubikey::Stub, p256::Recipient, util::Metadata),
+    printer: impl Fn(key::Stub, p256::Recipient, util::Metadata),
 ) -> Result<(), Error> {
     if let Some(slot) = flags.slot {
         print_single(flags.serial, slot, printer)
@@ -350,13 +350,13 @@ fn main() -> Result<(), Error> {
         eprintln!("make your choice, or press [Esc] or [q] to quit.");
         eprintln!();
 
-        if !Readers::open()?.iter()?.any(yubikey::is_connected) {
+        if !Readers::open()?.iter()?.any(key::is_connected) {
             eprintln!("⏳ Please insert the YubiKey you want to set up.");
         };
-        let mut readers = yubikey::wait_for_readers()?;
+        let mut readers = key::wait_for_readers()?;
 
         // Filter out readers we can't connect to.
-        let readers_list: Vec<_> = readers.iter()?.filter(yubikey::filter_connected).collect();
+        let readers_list: Vec<_> = readers.iter()?.filter(key::filter_connected).collect();
 
         let reader_names = readers_list
             .iter()
@@ -447,7 +447,7 @@ fn main() -> Result<(), Error> {
                     .with_prompt(&format!("Use existing identity in slot {}?", slot_index))
                     .interact()?
                 {
-                    let stub = yubikey::Stub::new(yubikey.serial(), slot, &recipient);
+                    let stub = key::Stub::new(yubikey.serial(), slot, &recipient);
                     let (_, cert) =
                         x509_parser::parse_x509_certificate(key.certificate().as_ref()).unwrap();
                     let metadata =
diff --git a/src/plugin.rs b/src/plugin.rs
index 6c18f23..9dcef53 100644
--- a/src/plugin.rs
+++ b/src/plugin.rs
@@ -7,12 +7,12 @@ use age_plugin::{
 use std::collections::HashMap;
 use std::io;
 
-use crate::{format, p256::Recipient, yubikey, PLUGIN_NAME};
+use crate::{format, key, p256::Recipient, PLUGIN_NAME};
 
 #[derive(Debug, Default)]
 pub(crate) struct RecipientPlugin {
     recipients: Vec<Recipient>,
-    yubikeys: Vec<yubikey::Stub>,
+    yubikeys: Vec<key::Stub>,
 }
 
 impl RecipientPluginV1 for RecipientPlugin {
@@ -44,7 +44,7 @@ impl RecipientPluginV1 for RecipientPlugin {
         bytes: &[u8],
     ) -> Result<(), recipient::Error> {
         if let Some(stub) = if plugin_name == PLUGIN_NAME {
-            yubikey::Stub::from_bytes(bytes, index)
+            key::Stub::from_bytes(bytes, index)
         } else {
             None
         } {
@@ -100,7 +100,7 @@ impl RecipientPluginV1 for RecipientPlugin {
 
 #[derive(Debug, Default)]
 pub(crate) struct IdentityPlugin {
-    yubikeys: Vec<yubikey::Stub>,
+    yubikeys: Vec<key::Stub>,
 }
 
 impl IdentityPluginV1 for IdentityPlugin {
@@ -111,7 +111,7 @@ impl IdentityPluginV1 for IdentityPlugin {
         bytes: &[u8],
     ) -> Result<(), identity::Error> {
         if let Some(stub) = if plugin_name == PLUGIN_NAME {
-            yubikey::Stub::from_bytes(bytes, index)
+            key::Stub::from_bytes(bytes, index)
         } else {
             None
         } {
@@ -133,14 +133,11 @@ impl IdentityPluginV1 for IdentityPlugin {
         let mut file_keys = HashMap::with_capacity(files.len());
 
         // Filter to files / stanzas for which we have matching YubiKeys
-        let mut candidate_stanzas: Vec<(
-            &yubikey::Stub,
-            HashMap<usize, Vec<format::RecipientLine>>,
-        )> = self
-            .yubikeys
-            .iter()
-            .map(|stub| (stub, HashMap::new()))
-            .collect();
+        let mut candidate_stanzas: Vec<(&key::Stub, HashMap<usize, Vec<format::RecipientLine>>)> =
+            self.yubikeys
+                .iter()
+                .map(|stub| (stub, HashMap::new()))
+                .collect();
 
         for (file, stanzas) in files.iter().enumerate() {
             for (stanza_index, stanza) in stanzas.iter().enumerate() {
diff --git a/src/util.rs b/src/util.rs
index b8fb968..eff29c0 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -7,7 +7,7 @@ use yubikey_piv::{
     Serial, YubiKey,
 };
 
-use crate::{error::Error, p256::Recipient, yubikey::Stub, BINARY_NAME, USABLE_SLOTS};
+use crate::{error::Error, key::Stub, p256::Recipient, BINARY_NAME, USABLE_SLOTS};
 
 pub(crate) const POLICY_EXTENSION_OID: &[u64] = &[1, 3, 6, 1, 4, 1, 41482, 3, 8];