allow subkeys, step 2