diff --git a/Makefile b/Makefile
index 12b3995..ca30b7f 100644
--- a/Makefile
+++ b/Makefile
@@ -21,7 +21,7 @@ templates/S4_server.py: src/S4_server.py keys/private_key.txt
 	sed -e 's/your@email.com/$(EMAIL)/' -e 's/YOUR-PRIVATE-KEY/'"$$(cat keys/private_key.txt)"'/' < src/S4_server.py > templates/S4_server.py
 	# XXX - HOST_* and VAPID_SUBJECT
 
-keys/public_key.txt keys/private_key.txt: venv S1_vapid.py
+keys/public_key.txt keys/private_key.txt keys/private_key.pem: venv S1_vapid.py
 	( $(VENVACT) && python S1_vapid.py )
 
 static/i-ico.png:
diff --git a/S1_vapid.py b/S1_vapid.py
index d66950e..648d3f2 100644
--- a/S1_vapid.py
+++ b/S1_vapid.py
@@ -6,7 +6,7 @@ import ecdsa
 # CREDITS : https://gist.github.com/cjies/cc014d55976db80f610cd94ccb2ab21e
 pri = ecdsa.SigningKey.generate(curve=ecdsa.NIST256p)
 pub = pri.get_verifying_key()
-private = base64.urlsafe_b64encode(pri.to_string()).decode("utf-8").strip("="),
+private = base64.urlsafe_b64encode(pri.to_string()).decode("utf-8").strip("=")
 public = base64.urlsafe_b64encode(b"\x04" + pub.to_string()).decode("utf-8").strip("=")
 
 import pathlib
@@ -19,3 +19,8 @@ with open(keydir / 'public_key.txt', 'w') as fp:
 
 with open(keydir / 'private_key.txt', 'w') as fp:
 	print(private, file=fp)
+
+with open(keydir / 'private_key.pem', 'wb') as fp:
+	#print(pri.to_pem(), file=fp)
+	# ecdsa is broken, to_pem returns bytes instead of a str
+	fp.write(pri.to_pem())
diff --git a/pushnotify.sh b/pushnotify.sh
index c66feb8..0235d72 100644
--- a/pushnotify.sh
+++ b/pushnotify.sh
@@ -1,9 +1,11 @@
 #!/bin/sh -
 
 subinfo="$1"
+privkey="$2"
+claim="$3"
 
-if ! [ -f "$1" ] || [ $# != 1 ]; then
-	echo "Usage: $0 <subinfo>"
+if ! [ -f "$1" ] || [ $# != 1 -a $# != 3 ]; then
+	echo "Usage: $0 <subinfo> [ <pemprivkey> <claimtxt> ]"
 	exit 1
 fi
 
@@ -13,6 +15,7 @@ cat - > "$tmpfname"
 title=$(grep -i "^Subject:" "$tmpfname" | sed -e 's/.*:[ 	]*//')
 
 jq --rawfile msg "$tmpfname" --arg title "$title" -n '{ "title": $title, "body": $msg, "icon" : "static/i-ico.png", "image" : "static/i-banner.png" }' |
-	pywebpush -v --data /dev/stdin --info "$subinfo"
+	pywebpush -v --data /dev/stdin --info "$subinfo" \
+		--key "${privkey}" --claims "${claim}"
 
 rm "$tmpfname"