How will the signer engine know which keys to sign with and which keys that are only published? The rnc will only allow publish state and not ready / active / retired.