diff --git a/include/polarssl/pk.h b/include/polarssl/pk.h
index 97e6cb9..584f77f 100644
--- a/include/polarssl/pk.h
+++ b/include/polarssl/pk.h
@@ -405,21 +405,6 @@
                   const unsigned char *key, size_t keylen,
                   const unsigned char *pwd, size_t pwdlen );
 
-#if defined(POLARSSL_FS_IO)
-/** \ingroup x509_module */
-/**
- * \brief           Load and parse a private key
- *
- * \param ctx       key to be initialized
- * \param path      filename to read the private key from
- * \param password  password to decrypt the file (can be NULL)
- *
- * \return          0 if successful, or a specific PK or PEM error code
- */
-int pk_parse_keyfile( pk_context *ctx,
-                      const char *path, const char *password );
-#endif /* POLARSSL_FS_IO */
-
 /** \ingroup x509_module */
 /**
  * \brief           Parse a public key
@@ -436,6 +421,19 @@
 #if defined(POLARSSL_FS_IO)
 /** \ingroup x509_module */
 /**
+ * \brief           Load and parse a private key
+ *
+ * \param ctx       key to be initialized
+ * \param path      filename to read the private key from
+ * \param password  password to decrypt the file (can be NULL)
+ *
+ * \return          0 if successful, or a specific PK or PEM error code
+ */
+int pk_parse_keyfile( pk_context *ctx,
+                      const char *path, const char *password );
+
+/** \ingroup x509_module */
+/**
  * \brief           Load and parse a public key
  *
  * \param ctx       key to be initialized
@@ -447,6 +445,65 @@
 #endif /* POLARSSL_FS_IO */
 
 /**
+ * \brief           Write a private key to a PKCS#1 or SEC1 DER structure
+ *                  Note: data is written at the end of the buffer! Use the
+ *                        return value to determine where you should start
+ *                        using the buffer
+ *
+ * \param key       private to write away
+ * \param buf       buffer to write to
+ * \param size      size of the buffer
+ *
+ * \return          length of data written if successful, or a specific
+ *                  error code
+ */
+int pk_write_key_der( pk_context *pk, unsigned char *buf, size_t size );
+
+/**
+ * \brief           Write a public key to a SubjectPublicKeyInfo DER structure
+ *                  Note: data is written at the end of the buffer! Use the
+ *                        return value to determine where you should start
+ *                        using the buffer
+ *
+ * \param key       public key to write away
+ * \param buf       buffer to write to
+ * \param size      size of the buffer
+ *
+ * \return          length of data written if successful, or a specific
+ *                  error code
+ */
+int pk_write_pubkey_der( pk_context *key, unsigned char *buf, size_t size );
+
+#if defined(POLARSSL_BASE64_C)
+/**
+ * \brief           Write a public key to a PEM string
+ *
+ * \param key       public key to write away
+ * \param buf       buffer to write to
+ * \param size      size of the buffer
+ *
+ * \return          0 successful, or a specific error code
+ */
+int pk_write_pubkey_pem( pk_context *key, unsigned char *buf, size_t size );
+
+/**
+ * \brief           Write a private key to a PKCS#1 or SEC1 PEM string
+ *
+ * \param key       private to write away
+ * \param buf       buffer to write to
+ * \param size      size of the buffer
+ *
+ * \return          0 successful, or a specific error code
+ */
+int pk_write_key_pem( pk_context *key, unsigned char *buf, size_t size );
+#endif /* POLARSSL_BASE64_C */
+
+/*
+ * WARNING: Low-level functions. You probably do not want to use these unless
+ *          you are certain you do ;)
+ */
+
+/**
  * \brief           Parse a SubjectPublicKeyInfo DER structure
  *
  * \param p         the position in the ASN.1 data
@@ -458,6 +515,19 @@
 int pk_parse_get_pubkey( unsigned char **p, const unsigned char *end,
                          pk_context *pk );
 
+/**
+ * \brief           Write a subjectPublicKey to ASN.1 data
+ *                  Note: function works backwards in data buffer
+ *
+ * \param p         reference to current position pointer
+ * \param start     start of the buffer (for bounds-checking)
+ * \param key       public key to write away
+ *
+ * \return          the length written or a negative error code
+ */
+int pk_write_pubkey( unsigned char **p, unsigned char *start,
+                     const pk_context *key );
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/polarssl/x509write.h b/include/polarssl/x509write.h
index 552d453..d41e708 100644
--- a/include/polarssl/x509write.h
+++ b/include/polarssl/x509write.h
@@ -390,36 +390,6 @@
                        void *p_rng );
 
 /**
- * \brief           Write a public key to a DER structure
- *                  Note: data is written at the end of the buffer! Use the
- *                        return value to determine where you should start
- *                        using the buffer
- *
- * \param key       public key to write away
- * \param buf       buffer to write to
- * \param size      size of the buffer
- *
- * \return          length of data written if successful, or a specific
- *                  error code
- */
-int x509write_pubkey_der( pk_context *key, unsigned char *buf, size_t size );
-
-/**
- * \brief           Write a private key to a PKCS#1 or SEC1 DER structure
- *                  Note: data is written at the end of the buffer! Use the
- *                        return value to determine where you should start
- *                        using the buffer
- *
- * \param key       private to write away
- * \param buf       buffer to write to
- * \param size      size of the buffer
- *
- * \return          length of data written if successful, or a specific
- *                  error code
- */
-int x509write_key_der( pk_context *pk, unsigned char *buf, size_t size );
-
-/**
  * \brief           Write a CSR (Certificate Signing Request) to a
  *                  DER structure
  *                  Note: data is written at the end of the buffer! Use the
@@ -466,28 +436,6 @@
                        void *p_rng );
 
 /**
- * \brief           Write a public key to a PEM string
- *
- * \param key       public key to write away
- * \param buf       buffer to write to
- * \param size      size of the buffer
- *
- * \return          0 successful, or a specific error code
- */
-int x509write_pubkey_pem( pk_context *key, unsigned char *buf, size_t size );
-
-/**
- * \brief           Write a private key to a PKCS#1 or SEC1 PEM string
- *
- * \param key       private to write away
- * \param buf       buffer to write to
- * \param size      size of the buffer
- *
- * \return          0 successful, or a specific error code
- */
-int x509write_key_pem( pk_context *key, unsigned char *buf, size_t size );
-
-/**
  * \brief           Write a CSR (Certificate Signing Request) to a
  *                  PEM string
  *