diff --git a/package.json b/package.json
index 8bee51f..30f8af4 100644
--- a/package.json
+++ b/package.json
@@ -18,8 +18,8 @@
   ],
   "scripts": {
     "lint": "aegir lint",
-    "build": "aegir build",
-    "build-proto": "pbjs --wrap commonjs --target static-module src/keys/keys.proto > src/keys/keys.proto.js",
+    "build": "npm run build:proto && aegir build",
+    "build:proto": "pbjs -t static-module -w commonjs --force-number --no-verify --no-delimited --no-create --no-beautify --no-defaults --lint eslint-disable -o src/keys/keys.js ./src/keys/keys.proto",
     "test": "aegir test",
     "test:node": "aegir test -t node",
     "test:browser": "aegir test -t browser -t webworker",
@@ -49,7 +49,7 @@
     "multihashing-async": "^2.1.2",
     "node-forge": "^0.10.0",
     "pem-jwk": "^2.0.0",
-    "protons": "^2.0.0",
+    "protobufjs": "^6.10.2",
     "secp256k1": "^4.0.0",
     "uint8arrays": "^2.1.4",
     "ursa-optional": "^0.10.1"
@@ -64,11 +64,11 @@
     "chai": "^4.2.0",
     "chai-string": "^1.5.0",
     "dirty-chai": "^2.0.1",
-    "sinon": "^10.0.0"
+    "sinon": "^10.0.0",
+    "util": "^0.12.3"
   },
   "engines": {
-    "node": ">=12.0.0",
-    "npm": ">=6.0.0"
+    "node": ">=12.0.0"
   },
   "repository": {
     "type": "git",
diff --git a/src/keys/ed25519-class.js b/src/keys/ed25519-class.js
index 221528b..4d324de 100644
--- a/src/keys/ed25519-class.js
+++ b/src/keys/ed25519-class.js
@@ -1,12 +1,11 @@
 'use strict'
 
 const sha = require('multihashing-async/src/sha')
-const protobuf = require('protons')
 const errcode = require('err-code')
 const uint8ArrayEquals = require('uint8arrays/equals')
 const mh = require('multihashes')
 const crypto = require('./ed25519')
-const pbm = protobuf(require('./keys.proto'))
+const pbm = require('./keys')
 const exporter = require('./exporter')
 
 class Ed25519PublicKey {
@@ -26,7 +25,7 @@ class Ed25519PublicKey {
     return pbm.PublicKey.encode({
       Type: pbm.KeyType.Ed25519,
       Data: this.marshal()
-    })
+    }).finish()
   }
 
   equals (key) {
@@ -62,7 +61,7 @@ class Ed25519PrivateKey {
     return pbm.PrivateKey.encode({
       Type: pbm.KeyType.Ed25519,
       Data: this.marshal()
-    })
+    }).finish()
   }
 
   equals (key) {
diff --git a/src/keys/index.js b/src/keys/index.js
index e84ae11..3a04a9a 100644
--- a/src/keys/index.js
+++ b/src/keys/index.js
@@ -1,7 +1,6 @@
 'use strict'
 
-const protobuf = require('protons')
-const keysPBM = protobuf(require('./keys.proto'))
+const keysPBM = require('./keys')
 require('node-forge/lib/asn1')
 require('node-forge/lib/pbe')
 const forge = require('node-forge/lib/forge')
diff --git a/src/keys/keys.js b/src/keys/keys.js
new file mode 100644
index 0000000..33c368c
--- /dev/null
+++ b/src/keys/keys.js
@@ -0,0 +1,378 @@
+/*eslint-disable*/
+"use strict";
+
+var $protobuf = require("protobufjs/minimal");
+
+// Common aliases
+var $Reader = $protobuf.Reader, $Writer = $protobuf.Writer, $util = $protobuf.util;
+
+// Exported root namespace
+var $root = $protobuf.roots["default"] || ($protobuf.roots["default"] = {});
+
+/**
+ * KeyType enum.
+ * @exports KeyType
+ * @enum {number}
+ * @property {number} RSA=0 RSA value
+ * @property {number} Ed25519=1 Ed25519 value
+ * @property {number} Secp256k1=2 Secp256k1 value
+ */
+$root.KeyType = (function() {
+    var valuesById = {}, values = Object.create(valuesById);
+    values[valuesById[0] = "RSA"] = 0;
+    values[valuesById[1] = "Ed25519"] = 1;
+    values[valuesById[2] = "Secp256k1"] = 2;
+    return values;
+})();
+
+$root.PublicKey = (function() {
+
+    /**
+     * Properties of a PublicKey.
+     * @exports IPublicKey
+     * @interface IPublicKey
+     * @property {KeyType} Type PublicKey Type
+     * @property {Uint8Array} Data PublicKey Data
+     */
+
+    /**
+     * Constructs a new PublicKey.
+     * @exports PublicKey
+     * @classdesc Represents a PublicKey.
+     * @implements IPublicKey
+     * @constructor
+     * @param {IPublicKey=} [p] Properties to set
+     */
+    function PublicKey(p) {
+        if (p)
+            for (var ks = Object.keys(p), i = 0; i < ks.length; ++i)
+                if (p[ks[i]] != null)
+                    this[ks[i]] = p[ks[i]];
+    }
+
+    /**
+     * PublicKey Type.
+     * @member {KeyType} Type
+     * @memberof PublicKey
+     * @instance
+     */
+    PublicKey.prototype.Type = 0;
+
+    /**
+     * PublicKey Data.
+     * @member {Uint8Array} Data
+     * @memberof PublicKey
+     * @instance
+     */
+    PublicKey.prototype.Data = $util.newBuffer([]);
+
+    /**
+     * Encodes the specified PublicKey message. Does not implicitly {@link PublicKey.verify|verify} messages.
+     * @function encode
+     * @memberof PublicKey
+     * @static
+     * @param {IPublicKey} m PublicKey message or plain object to encode
+     * @param {$protobuf.Writer} [w] Writer to encode to
+     * @returns {$protobuf.Writer} Writer
+     */
+    PublicKey.encode = function encode(m, w) {
+        if (!w)
+            w = $Writer.create();
+        w.uint32(8).int32(m.Type);
+        w.uint32(18).bytes(m.Data);
+        return w;
+    };
+
+    /**
+     * Decodes a PublicKey message from the specified reader or buffer.
+     * @function decode
+     * @memberof PublicKey
+     * @static
+     * @param {$protobuf.Reader|Uint8Array} r Reader or buffer to decode from
+     * @param {number} [l] Message length if known beforehand
+     * @returns {PublicKey} PublicKey
+     * @throws {Error} If the payload is not a reader or valid buffer
+     * @throws {$protobuf.util.ProtocolError} If required fields are missing
+     */
+    PublicKey.decode = function decode(r, l) {
+        if (!(r instanceof $Reader))
+            r = $Reader.create(r);
+        var c = l === undefined ? r.len : r.pos + l, m = new $root.PublicKey();
+        while (r.pos < c) {
+            var t = r.uint32();
+            switch (t >>> 3) {
+            case 1:
+                m.Type = r.int32();
+                break;
+            case 2:
+                m.Data = r.bytes();
+                break;
+            default:
+                r.skipType(t & 7);
+                break;
+            }
+        }
+        if (!m.hasOwnProperty("Type"))
+            throw $util.ProtocolError("missing required 'Type'", { instance: m });
+        if (!m.hasOwnProperty("Data"))
+            throw $util.ProtocolError("missing required 'Data'", { instance: m });
+        return m;
+    };
+
+    /**
+     * Creates a PublicKey message from a plain object. Also converts values to their respective internal types.
+     * @function fromObject
+     * @memberof PublicKey
+     * @static
+     * @param {Object.<string,*>} d Plain object
+     * @returns {PublicKey} PublicKey
+     */
+    PublicKey.fromObject = function fromObject(d) {
+        if (d instanceof $root.PublicKey)
+            return d;
+        var m = new $root.PublicKey();
+        switch (d.Type) {
+        case "RSA":
+        case 0:
+            m.Type = 0;
+            break;
+        case "Ed25519":
+        case 1:
+            m.Type = 1;
+            break;
+        case "Secp256k1":
+        case 2:
+            m.Type = 2;
+            break;
+        }
+        if (d.Data != null) {
+            if (typeof d.Data === "string")
+                $util.base64.decode(d.Data, m.Data = $util.newBuffer($util.base64.length(d.Data)), 0);
+            else if (d.Data.length)
+                m.Data = d.Data;
+        }
+        return m;
+    };
+
+    /**
+     * Creates a plain object from a PublicKey message. Also converts values to other types if specified.
+     * @function toObject
+     * @memberof PublicKey
+     * @static
+     * @param {PublicKey} m PublicKey
+     * @param {$protobuf.IConversionOptions} [o] Conversion options
+     * @returns {Object.<string,*>} Plain object
+     */
+    PublicKey.toObject = function toObject(m, o) {
+        if (!o)
+            o = {};
+        var d = {};
+        if (o.defaults) {
+            d.Type = o.enums === String ? "RSA" : 0;
+            if (o.bytes === String)
+                d.Data = "";
+            else {
+                d.Data = [];
+                if (o.bytes !== Array)
+                    d.Data = $util.newBuffer(d.Data);
+            }
+        }
+        if (m.Type != null && m.hasOwnProperty("Type")) {
+            d.Type = o.enums === String ? $root.KeyType[m.Type] : m.Type;
+        }
+        if (m.Data != null && m.hasOwnProperty("Data")) {
+            d.Data = o.bytes === String ? $util.base64.encode(m.Data, 0, m.Data.length) : o.bytes === Array ? Array.prototype.slice.call(m.Data) : m.Data;
+        }
+        return d;
+    };
+
+    /**
+     * Converts this PublicKey to JSON.
+     * @function toJSON
+     * @memberof PublicKey
+     * @instance
+     * @returns {Object.<string,*>} JSON object
+     */
+    PublicKey.prototype.toJSON = function toJSON() {
+        return this.constructor.toObject(this, $protobuf.util.toJSONOptions);
+    };
+
+    return PublicKey;
+})();
+
+$root.PrivateKey = (function() {
+
+    /**
+     * Properties of a PrivateKey.
+     * @exports IPrivateKey
+     * @interface IPrivateKey
+     * @property {KeyType} Type PrivateKey Type
+     * @property {Uint8Array} Data PrivateKey Data
+     */
+
+    /**
+     * Constructs a new PrivateKey.
+     * @exports PrivateKey
+     * @classdesc Represents a PrivateKey.
+     * @implements IPrivateKey
+     * @constructor
+     * @param {IPrivateKey=} [p] Properties to set
+     */
+    function PrivateKey(p) {
+        if (p)
+            for (var ks = Object.keys(p), i = 0; i < ks.length; ++i)
+                if (p[ks[i]] != null)
+                    this[ks[i]] = p[ks[i]];
+    }
+
+    /**
+     * PrivateKey Type.
+     * @member {KeyType} Type
+     * @memberof PrivateKey
+     * @instance
+     */
+    PrivateKey.prototype.Type = 0;
+
+    /**
+     * PrivateKey Data.
+     * @member {Uint8Array} Data
+     * @memberof PrivateKey
+     * @instance
+     */
+    PrivateKey.prototype.Data = $util.newBuffer([]);
+
+    /**
+     * Encodes the specified PrivateKey message. Does not implicitly {@link PrivateKey.verify|verify} messages.
+     * @function encode
+     * @memberof PrivateKey
+     * @static
+     * @param {IPrivateKey} m PrivateKey message or plain object to encode
+     * @param {$protobuf.Writer} [w] Writer to encode to
+     * @returns {$protobuf.Writer} Writer
+     */
+    PrivateKey.encode = function encode(m, w) {
+        if (!w)
+            w = $Writer.create();
+        w.uint32(8).int32(m.Type);
+        w.uint32(18).bytes(m.Data);
+        return w;
+    };
+
+    /**
+     * Decodes a PrivateKey message from the specified reader or buffer.
+     * @function decode
+     * @memberof PrivateKey
+     * @static
+     * @param {$protobuf.Reader|Uint8Array} r Reader or buffer to decode from
+     * @param {number} [l] Message length if known beforehand
+     * @returns {PrivateKey} PrivateKey
+     * @throws {Error} If the payload is not a reader or valid buffer
+     * @throws {$protobuf.util.ProtocolError} If required fields are missing
+     */
+    PrivateKey.decode = function decode(r, l) {
+        if (!(r instanceof $Reader))
+            r = $Reader.create(r);
+        var c = l === undefined ? r.len : r.pos + l, m = new $root.PrivateKey();
+        while (r.pos < c) {
+            var t = r.uint32();
+            switch (t >>> 3) {
+            case 1:
+                m.Type = r.int32();
+                break;
+            case 2:
+                m.Data = r.bytes();
+                break;
+            default:
+                r.skipType(t & 7);
+                break;
+            }
+        }
+        if (!m.hasOwnProperty("Type"))
+            throw $util.ProtocolError("missing required 'Type'", { instance: m });
+        if (!m.hasOwnProperty("Data"))
+            throw $util.ProtocolError("missing required 'Data'", { instance: m });
+        return m;
+    };
+
+    /**
+     * Creates a PrivateKey message from a plain object. Also converts values to their respective internal types.
+     * @function fromObject
+     * @memberof PrivateKey
+     * @static
+     * @param {Object.<string,*>} d Plain object
+     * @returns {PrivateKey} PrivateKey
+     */
+    PrivateKey.fromObject = function fromObject(d) {
+        if (d instanceof $root.PrivateKey)
+            return d;
+        var m = new $root.PrivateKey();
+        switch (d.Type) {
+        case "RSA":
+        case 0:
+            m.Type = 0;
+            break;
+        case "Ed25519":
+        case 1:
+            m.Type = 1;
+            break;
+        case "Secp256k1":
+        case 2:
+            m.Type = 2;
+            break;
+        }
+        if (d.Data != null) {
+            if (typeof d.Data === "string")
+                $util.base64.decode(d.Data, m.Data = $util.newBuffer($util.base64.length(d.Data)), 0);
+            else if (d.Data.length)
+                m.Data = d.Data;
+        }
+        return m;
+    };
+
+    /**
+     * Creates a plain object from a PrivateKey message. Also converts values to other types if specified.
+     * @function toObject
+     * @memberof PrivateKey
+     * @static
+     * @param {PrivateKey} m PrivateKey
+     * @param {$protobuf.IConversionOptions} [o] Conversion options
+     * @returns {Object.<string,*>} Plain object
+     */
+    PrivateKey.toObject = function toObject(m, o) {
+        if (!o)
+            o = {};
+        var d = {};
+        if (o.defaults) {
+            d.Type = o.enums === String ? "RSA" : 0;
+            if (o.bytes === String)
+                d.Data = "";
+            else {
+                d.Data = [];
+                if (o.bytes !== Array)
+                    d.Data = $util.newBuffer(d.Data);
+            }
+        }
+        if (m.Type != null && m.hasOwnProperty("Type")) {
+            d.Type = o.enums === String ? $root.KeyType[m.Type] : m.Type;
+        }
+        if (m.Data != null && m.hasOwnProperty("Data")) {
+            d.Data = o.bytes === String ? $util.base64.encode(m.Data, 0, m.Data.length) : o.bytes === Array ? Array.prototype.slice.call(m.Data) : m.Data;
+        }
+        return d;
+    };
+
+    /**
+     * Converts this PrivateKey to JSON.
+     * @function toJSON
+     * @memberof PrivateKey
+     * @instance
+     * @returns {Object.<string,*>} JSON object
+     */
+    PrivateKey.prototype.toJSON = function toJSON() {
+        return this.constructor.toObject(this, $protobuf.util.toJSONOptions);
+    };
+
+    return PrivateKey;
+})();
+
+module.exports = $root;
diff --git a/src/keys/keys.proto.js b/src/keys/keys.proto
similarity index 80%
rename from src/keys/keys.proto.js
rename to src/keys/keys.proto
index 4e0ab08..87f333d 100644
--- a/src/keys/keys.proto.js
+++ b/src/keys/keys.proto
@@ -1,6 +1,4 @@
-'use strict'
-
-module.exports = `enum KeyType {
+enum KeyType {
   RSA = 0;
   Ed25519 = 1;
   Secp256k1 = 2;
@@ -12,4 +10,4 @@ message PublicKey {
 message PrivateKey {
   required KeyType Type = 1;
   required bytes Data = 2;
-}`
+}
diff --git a/src/keys/rsa-class.js b/src/keys/rsa-class.js
index c4edd12..38e14bc 100644
--- a/src/keys/rsa-class.js
+++ b/src/keys/rsa-class.js
@@ -1,7 +1,6 @@
 'use strict'
 
 const sha = require('multihashing-async/src/sha')
-const protobuf = require('protons')
 const errcode = require('err-code')
 const uint8ArrayEquals = require('uint8arrays/equals')
 const uint8ArrayToString = require('uint8arrays/to-string')
@@ -11,7 +10,7 @@ require('node-forge/lib/ed25519')
 const forge = require('node-forge/lib/forge')
 
 const crypto = require('./rsa')
-const pbm = protobuf(require('./keys.proto'))
+const pbm = require('./keys')
 const exporter = require('./exporter')
 
 class RsaPublicKey {
@@ -31,7 +30,7 @@ class RsaPublicKey {
     return pbm.PublicKey.encode({
       Type: pbm.KeyType.RSA,
       Data: this.marshal()
-    })
+    }).finish()
   }
 
   encrypt (bytes) {
@@ -83,7 +82,7 @@ class RsaPrivateKey {
     return pbm.PrivateKey.encode({
       Type: pbm.KeyType.RSA,
       Data: this.marshal()
-    })
+    }).finish()
   }
 
   equals (key) {
diff --git a/src/keys/secp256k1-class.js b/src/keys/secp256k1-class.js
index 14483be..35d735c 100644
--- a/src/keys/secp256k1-class.js
+++ b/src/keys/secp256k1-class.js
@@ -28,7 +28,7 @@ module.exports = (keysProtobuf, randomBytes, crypto) => {
       return keysProtobuf.PublicKey.encode({
         Type: keysProtobuf.KeyType.Secp256k1,
         Data: this.marshal()
-      })
+      }).finish()
     }
 
     equals (key) {
@@ -64,7 +64,7 @@ module.exports = (keysProtobuf, randomBytes, crypto) => {
       return keysProtobuf.PrivateKey.encode({
         Type: keysProtobuf.KeyType.Secp256k1,
         Data: this.marshal()
-      })
+      }).finish()
     }
 
     equals (key) {