diff --git a/modules/__tests__/_publicKey-test.js b/modules/__tests__/_publicKey-test.js
deleted file mode 100644
index e72f3d6..0000000
--- a/modules/__tests__/_publicKey-test.js
+++ /dev/null
@@ -1,21 +0,0 @@
-import request from 'supertest';
-
-import createServer from '../createServer';
-
-describe('The /_publicKey endpoint', () => {
-  let server;
-  beforeEach(() => {
-    server = createServer();
-  });
-
-  describe('GET /_publicKey', () => {
-    it('echoes the public key', done => {
-      request(server)
-        .get('/_publicKey')
-        .end((err, res) => {
-          expect(res.text).toMatch(/PUBLIC KEY/);
-          done();
-        });
-    });
-  });
-});
diff --git a/modules/__tests__/api-publicKey-test.js b/modules/__tests__/api-publicKey-test.js
deleted file mode 100644
index 0666ab7..0000000
--- a/modules/__tests__/api-publicKey-test.js
+++ /dev/null
@@ -1,21 +0,0 @@
-import request from 'supertest';
-
-import createServer from '../createServer';
-
-describe('The /api/publicKey endpoint', () => {
-  let server;
-  beforeEach(() => {
-    server = createServer();
-  });
-
-  describe('GET /api/publicKey', () => {
-    it('echoes the public key', done => {
-      request(server)
-        .get('/api/publicKey')
-        .end((err, res) => {
-          expect(res.text).toMatch(/PUBLIC KEY/);
-          done();
-        });
-    });
-  });
-});
diff --git a/modules/actions/servePublicKey.js b/modules/actions/servePublicKey.js
deleted file mode 100644
index 5c55f4f..0000000
--- a/modules/actions/servePublicKey.js
+++ /dev/null
@@ -1,5 +0,0 @@
-import { publicKey } from '../utils/secret';
-
-export default function servePublicKey(req, res) {
-  res.send({ publicKey });
-}
diff --git a/modules/server.js b/modules/server.js
index 7fceed0..a0bf2e1 100644
--- a/modules/server.js
+++ b/modules/server.js
@@ -1,9 +1,7 @@
 import express from 'express';
 
-// import serveAuth from './actions/serveAuth';
 import serveFile from './actions/serveFile';
 import serveMainPage from './actions/serveMainPage';
-import servePublicKey from './actions/servePublicKey';
 import serveStats from './actions/serveStats';
 
 import cors from './middleware/cors';
@@ -12,7 +10,6 @@ import findFile from './middleware/findFile';
 import logger from './middleware/logger';
 import redirectLegacyURLs from './middleware/redirectLegacyURLs';
 import staticFiles from './middleware/staticFiles';
-// import userToken from './middleware/userToken';
 import validatePackageURL from './middleware/validatePackageURL';
 import validatePackageName from './middleware/validatePackageName';
 import validateQuery from './middleware/validateQuery';
@@ -43,8 +40,6 @@ app.use(redirectLegacyURLs);
 app.use(
   '/api',
   createRouter(app => {
-    // app.get('/auth', userToken, serveAuth);
-    app.get('/public-key', servePublicKey);
     app.get('/stats', serveStats);
   })
 );
diff --git a/modules/utils/secret.js b/modules/utils/secret.js
deleted file mode 100644
index 019bd5a..0000000
--- a/modules/utils/secret.js
+++ /dev/null
@@ -1,8 +0,0 @@
-import invariant from 'invariant';
-
-const secretKey = process.env.SECRET_KEY;
-
-invariant(secretKey, 'Missing $SECRET_KEY environment variable');
-
-export const privateKey = secretKey.private;
-export const publicKey = secretKey.public;
diff --git a/package.json b/package.json
index 93ffd0f..fdc4dc2 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "description": "The CDN for everything on npm",
   "scripts": {
     "build": "rollup -c",
-    "clean": "git clean -e '!/secret_key' -e '!/.env' -fdX .",
+    "clean": "git clean -e '!/.env' -fdX .",
     "lint": "eslint modules",
     "test": "jest",
     "watch": "rollup -c -w"
diff --git a/rollup.config.js b/rollup.config.js
index d19ab6a..649b6d5 100644
--- a/rollup.config.js
+++ b/rollup.config.js
@@ -12,7 +12,6 @@ const url = require('rollup-plugin-url');
 
 const entryManifest = require('./plugins/entryManifest');
 const pkg = require('./package.json');
-const secretKey = require('./secretKey');
 
 const env = process.env.NODE_ENV || 'development';
 const dev = env === 'development';
@@ -91,8 +90,7 @@ const server = {
       'process.env.NPM_REGISTRY_URL': JSON.stringify(
         process.env.NPM_REGISTRY_URL
       ),
-      'process.env.ORIGIN': JSON.stringify(process.env.ORIGIN),
-      'process.env.SECRET_KEY': JSON.stringify(secretKey)
+      'process.env.ORIGIN': JSON.stringify(process.env.ORIGIN)
     })
   ]
 };
diff --git a/secretKey.js b/secretKey.js
deleted file mode 100644
index 3ca76cd..0000000
--- a/secretKey.js
+++ /dev/null
@@ -1,25 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-const forge = require('node-forge');
-
-function readFile(file) {
-  return fs.readFileSync(path.resolve(__dirname, file), 'utf8');
-}
-
-let secretKey;
-if (process.env.NODE_ENV === 'production') {
-  secretKey = {
-    public: readFile('./secret_key.pub'),
-    private: readFile('./secret_key')
-  };
-} else {
-  // Generate a random keypair for dev/testing.
-  // See https://gist.github.com/sebadoom/2b70969e70db5da9a203bebd9cff099f
-  const keypair = forge.rsa.generateKeyPair({ bits: 2048 });
-  secretKey = {
-    public: forge.pki.publicKeyToPem(keypair.publicKey, 72),
-    private: forge.pki.privateKeyToPem(keypair.privateKey, 72)
-  };
-}
-
-module.exports = secretKey;
diff --git a/secret_key.pub b/secret_key.pub
deleted file mode 100644
index 41d61cf..0000000
--- a/secret_key.pub
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtWG6vJVKV8+hGDXtYS3i
-JN8DO4xsKAM7n72IMH3489J1UUwdFdP3CKAAQzl8kcet/9q5CrLeUnW5oQNezQiC
-FcSgF/KhJBITMWe5IIVWZOsFMvvNR+vISSL6We842gEAZWJbo2HZdFTdZjfino/4
-CL3Sr0Ue9PFVHcVkT9V7uS7f/7VbwKFbxdpesYeq8odNFPQy6rhmSBT9v0mGK36K
-f7kPuVqV7xlZ8nfiHdP+TAP2I4Iv2Ok7kMMy2qPjwizCShPcLIHzmyVdRuoUvxTf
-cvC/cI3NUC7Qconn9tEtyvFzegdhS0tQD+Mq9eWAEZYp0rV/TkkaAYkIOkVQoiwQ
-9QIDAQAB
------END PUBLIC KEY-----