diff --git a/cmd/init.go b/cmd/init.go
new file mode 100644
index 0000000..3e2d4d6
--- /dev/null
+++ b/cmd/init.go
@@ -0,0 +1,397 @@
+package cmd
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"net/netip"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/encodeous/nylon/state"
+	"github.com/goccy/go-yaml"
+	"github.com/spf13/cobra"
+)
+
+type initOptions struct {
+	id               string
+	port             uint16
+	key              string
+	output           string
+	force            bool
+	useSystemRouting bool
+	noNetConfigure   bool
+	dnsResolvers     []string
+	interfaceName    string
+	logPath          string
+	distURL          string
+	distKey          string
+	unexcludeIPs     []string
+	excludeIPs       []string
+	preUp            []string
+	preDown          []string
+	postUp           []string
+	postDown         []string
+}
+
+func newInitCmd() *cobra.Command {
+	opts := initOptions{}
+	cmd := &cobra.Command{
+		Use:     "init",
+		Short:   "Generate a node configuration",
+		GroupID: "init",
+		Args:    cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			if opts.id == "" {
+				if err := promptInitOptions(cmd, &opts); err != nil {
+					return err
+				}
+			}
+
+			cfg, err := buildNodeConfig(opts)
+			if err != nil {
+				return err
+			}
+
+			data, err := yaml.Marshal(cfg)
+			if err != nil {
+				return fmt.Errorf("encode node config: %w", err)
+			}
+
+			flags := os.O_WRONLY | os.O_CREATE
+			if opts.force {
+				flags |= os.O_TRUNC
+			} else {
+				flags |= os.O_EXCL
+			}
+			file, err := os.OpenFile(opts.output, flags, 0o600)
+			if err != nil {
+				if errors.Is(err, os.ErrExist) {
+					return fmt.Errorf("%s already exists (use --force to overwrite)", opts.output)
+				}
+				return fmt.Errorf("create %s: %w", opts.output, err)
+			}
+			if err = file.Chmod(0o600); err != nil {
+				_ = file.Close()
+				return fmt.Errorf("secure %s: %w", opts.output, err)
+			}
+			if _, err = file.Write(data); err != nil {
+				_ = file.Close()
+				return fmt.Errorf("write %s: %w", opts.output, err)
+			}
+			if err = file.Close(); err != nil {
+				return fmt.Errorf("close %s: %w", opts.output, err)
+			}
+
+			publicKey, err := cfg.Key.Pubkey().MarshalText()
+			if err != nil {
+				return fmt.Errorf("encode public key: %w", err)
+			}
+			fmt.Fprintf(cmd.OutOrStdout(), "Created %s\nPublic key: %s\n", opts.output, publicKey)
+			return nil
+		},
+	}
+
+	flags := cmd.Flags()
+	flags.StringVar(&opts.id, "id", "", "Unique node ID (required)")
+	flags.Uint16Var(&opts.port, "port", 57175, "UDP port Nylon listens on")
+	flags.StringVar(&opts.key, "key", "", "Existing private key (a new key is generated if omitted)")
+	flags.StringVarP(&opts.output, "output", "o", DefaultNodeConfigPath, "Node config output path")
+	flags.BoolVar(&opts.force, "force", false, "Overwrite the output file if it exists")
+	flags.BoolVar(&opts.useSystemRouting, "use-system-routing", false, "Route peer packets through the system")
+	flags.BoolVar(&opts.noNetConfigure, "no-net-configure", false, "Do not configure system networking")
+	flags.StringSliceVar(&opts.dnsResolvers, "dns-resolver", nil, "DNS resolver in ip:port form (repeatable)")
+	flags.StringVar(&opts.interfaceName, "interface-name", "", "Nylon interface name")
+	flags.StringVar(&opts.logPath, "log-path", "", "Log file path")
+	flags.StringVar(&opts.distURL, "dist-url", "", "Configuration distribution URL")
+	flags.StringVar(&opts.distKey, "dist-key", "", "Configuration distribution shared key")
+	flags.StringSliceVar(&opts.unexcludeIPs, "unexclude-ip", nil, "Centrally excluded IP prefix to include (repeatable)")
+	flags.StringSliceVar(&opts.excludeIPs, "exclude-ip", nil, "IP prefix to exclude (repeatable)")
+	flags.StringSliceVar(&opts.preUp, "pre-up", nil, "Command to run before interface startup (repeatable)")
+	flags.StringSliceVar(&opts.preDown, "pre-down", nil, "Command to run before interface shutdown (repeatable)")
+	flags.StringSliceVar(&opts.postUp, "post-up", nil, "Command to run after interface startup (repeatable)")
+	flags.StringSliceVar(&opts.postDown, "post-down", nil, "Command to run after interface shutdown (repeatable)")
+	return cmd
+}
+
+type initPrompter struct {
+	scanner *bufio.Scanner
+	output  io.Writer
+}
+
+func promptInitOptions(cmd *cobra.Command, opts *initOptions) error {
+	prompter := initPrompter{
+		scanner: bufio.NewScanner(cmd.InOrStdin()),
+		output:  cmd.OutOrStdout(),
+	}
+
+	fmt.Fprintln(prompter.output, "Interactive node configuration (press Enter to accept a default)")
+
+	for {
+		id, err := prompter.stringValue("Node ID", opts.id)
+		if err != nil {
+			return err
+		}
+		if id == "" {
+			fmt.Fprintln(prompter.output, "Node ID is required.")
+			continue
+		}
+		if err := state.NameValidator(id); err != nil {
+			fmt.Fprintf(prompter.output, "Invalid node ID: %v\n", err)
+			continue
+		}
+		opts.id = id
+		break
+	}
+
+	port, err := prompter.portValue("UDP port", opts.port)
+	if err != nil {
+		return err
+	}
+	opts.port = port
+
+	output, err := prompter.stringValue("Output path", opts.output)
+	if err != nil {
+		return err
+	}
+	opts.output = output
+	if _, err := os.Stat(opts.output); err == nil {
+		overwrite, promptErr := prompter.boolValue("Output already exists; overwrite it", opts.force)
+		if promptErr != nil {
+			return promptErr
+		}
+		if !overwrite {
+			return fmt.Errorf("%s already exists (use --force to overwrite)", opts.output)
+		}
+		opts.force = true
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("inspect %s: %w", opts.output, err)
+	}
+
+	key, err := prompter.stringValue("Existing private key (leave blank to generate one)", opts.key)
+	if err != nil {
+		return err
+	}
+	opts.key = key
+
+	advanced, err := prompter.boolValue("Configure advanced options", hasAdvancedInitOptions(*opts))
+	if err != nil {
+		return err
+	}
+	if !advanced {
+		return nil
+	}
+
+	if opts.useSystemRouting, err = prompter.boolValue("Use system routing", opts.useSystemRouting); err != nil {
+		return err
+	}
+	if opts.noNetConfigure, err = prompter.boolValue("Disable automatic network configuration", opts.noNetConfigure); err != nil {
+		return err
+	}
+	if opts.dnsResolvers, err = prompter.listValue("DNS resolvers (comma-separated ip:port values)", opts.dnsResolvers); err != nil {
+		return err
+	}
+	if opts.interfaceName, err = prompter.stringValue("Interface name", opts.interfaceName); err != nil {
+		return err
+	}
+	if opts.logPath, err = prompter.stringValue("Log path", opts.logPath); err != nil {
+		return err
+	}
+
+	distribution, err := prompter.boolValue("Configure remote configuration distribution", opts.distURL != "" || opts.distKey != "")
+	if err != nil {
+		return err
+	}
+	if distribution {
+		if opts.distURL, err = prompter.stringValue("Distribution URL", opts.distURL); err != nil {
+			return err
+		}
+		if opts.distKey, err = prompter.stringValue("Distribution shared key", opts.distKey); err != nil {
+			return err
+		}
+	} else {
+		opts.distURL = ""
+		opts.distKey = ""
+	}
+
+	if opts.unexcludeIPs, err = prompter.listValue("IP prefixes to unexclude (comma-separated)", opts.unexcludeIPs); err != nil {
+		return err
+	}
+	if opts.excludeIPs, err = prompter.listValue("IP prefixes to exclude (comma-separated)", opts.excludeIPs); err != nil {
+		return err
+	}
+	if opts.preUp, err = prompter.listValue("Pre-up commands (comma-separated)", opts.preUp); err != nil {
+		return err
+	}
+	if opts.preDown, err = prompter.listValue("Pre-down commands (comma-separated)", opts.preDown); err != nil {
+		return err
+	}
+	if opts.postUp, err = prompter.listValue("Post-up commands (comma-separated)", opts.postUp); err != nil {
+		return err
+	}
+	if opts.postDown, err = prompter.listValue("Post-down commands (comma-separated)", opts.postDown); err != nil {
+		return err
+	}
+	return nil
+}
+
+func hasAdvancedInitOptions(opts initOptions) bool {
+	return opts.useSystemRouting || opts.noNetConfigure || len(opts.dnsResolvers) > 0 ||
+		opts.interfaceName != "" || opts.logPath != "" || opts.distURL != "" || opts.distKey != "" ||
+		len(opts.unexcludeIPs) > 0 || len(opts.excludeIPs) > 0 || len(opts.preUp) > 0 ||
+		len(opts.preDown) > 0 || len(opts.postUp) > 0 || len(opts.postDown) > 0
+}
+
+func (p *initPrompter) readLine(prompt string) (string, error) {
+	fmt.Fprint(p.output, prompt)
+	if !p.scanner.Scan() {
+		if err := p.scanner.Err(); err != nil {
+			return "", fmt.Errorf("read interactive input: %w", err)
+		}
+		return "", errors.New("interactive input ended before configuration was complete")
+	}
+	return strings.TrimSpace(p.scanner.Text()), nil
+}
+
+func (p *initPrompter) stringValue(label, current string) (string, error) {
+	prompt := label + ": "
+	if current != "" {
+		prompt = fmt.Sprintf("%s [%s]: ", label, current)
+	}
+	value, err := p.readLine(prompt)
+	if err != nil {
+		return "", err
+	}
+	if value == "" {
+		return current, nil
+	}
+	return value, nil
+}
+
+func (p *initPrompter) portValue(label string, current uint16) (uint16, error) {
+	for {
+		value, err := p.readLine(fmt.Sprintf("%s [%d]: ", label, current))
+		if err != nil {
+			return 0, err
+		}
+		if value == "" {
+			return current, nil
+		}
+		parsed, parseErr := strconv.ParseUint(value, 10, 16)
+		if parseErr == nil && parsed > 0 {
+			return uint16(parsed), nil
+		}
+		fmt.Fprintln(p.output, "Port must be a number between 1 and 65535.")
+	}
+}
+
+func (p *initPrompter) boolValue(label string, current bool) (bool, error) {
+	defaultHint := "y/N"
+	if current {
+		defaultHint = "Y/n"
+	}
+	for {
+		value, err := p.readLine(fmt.Sprintf("%s? [%s]: ", label, defaultHint))
+		if err != nil {
+			return false, err
+		}
+		switch strings.ToLower(value) {
+		case "":
+			return current, nil
+		case "y", "yes", "true":
+			return true, nil
+		case "n", "no", "false":
+			return false, nil
+		default:
+			fmt.Fprintln(p.output, "Please answer yes or no.")
+		}
+	}
+}
+
+func (p *initPrompter) listValue(label string, current []string) ([]string, error) {
+	prompt := label + ": "
+	if len(current) > 0 {
+		prompt = fmt.Sprintf("%s [%s]: ", label, strings.Join(current, ", "))
+	}
+	value, err := p.readLine(prompt)
+	if err != nil {
+		return nil, err
+	}
+	if value == "" {
+		return current, nil
+	}
+	values := strings.Split(value, ",")
+	result := make([]string, 0, len(values))
+	for _, item := range values {
+		if item = strings.TrimSpace(item); item != "" {
+			result = append(result, item)
+		}
+	}
+	return result, nil
+}
+
+func buildNodeConfig(opts initOptions) (*state.LocalCfg, error) {
+	privateKey := state.GenerateKey()
+	if opts.key != "" {
+		if err := privateKey.UnmarshalText([]byte(opts.key)); err != nil {
+			return nil, fmt.Errorf("invalid private key: %w", err)
+		}
+	}
+
+	cfg := &state.LocalCfg{
+		Key:              privateKey,
+		Id:               state.NodeId(opts.id),
+		Port:             opts.port,
+		UseSystemRouting: opts.useSystemRouting,
+		NoNetConfigure:   opts.noNetConfigure,
+		DnsResolvers:     opts.dnsResolvers,
+		InterfaceName:    opts.interfaceName,
+		LogPath:          opts.logPath,
+		PreUp:            opts.preUp,
+		PreDown:          opts.preDown,
+		PostUp:           opts.postUp,
+		PostDown:         opts.postDown,
+	}
+
+	var err error
+	if cfg.UnexcludeIPs, err = parsePrefixes(opts.unexcludeIPs); err != nil {
+		return nil, fmt.Errorf("invalid --unexclude-ip: %w", err)
+	}
+	if cfg.ExcludeIPs, err = parsePrefixes(opts.excludeIPs); err != nil {
+		return nil, fmt.Errorf("invalid --exclude-ip: %w", err)
+	}
+
+	if (opts.distURL == "") != (opts.distKey == "") {
+		return nil, errors.New("--dist-url and --dist-key must be provided together")
+	}
+	if opts.distURL != "" {
+		var key state.NyPublicKey
+		if err := key.UnmarshalText([]byte(opts.distKey)); err != nil {
+			return nil, fmt.Errorf("invalid distribution key: %w", err)
+		}
+		cfg.Dist = &state.LocalDistributionCfg{Url: opts.distURL, Key: key}
+	}
+
+	if err := state.NodeConfigValidator(nil, cfg); err != nil {
+		return nil, fmt.Errorf("invalid node config: %w", err)
+	}
+	return cfg, nil
+}
+
+func parsePrefixes(values []string) ([]netip.Prefix, error) {
+	prefixes := make([]netip.Prefix, 0, len(values))
+	for _, value := range values {
+		prefix, err := netip.ParsePrefix(value)
+		if err != nil {
+			return nil, fmt.Errorf("%q: %w", value, err)
+		}
+		prefixes = append(prefixes, prefix)
+	}
+	return prefixes, nil
+}
+
+func init() {
+	rootCmd.AddCommand(newInitCmd())
+}
diff --git a/cmd/init_test.go b/cmd/init_test.go
new file mode 100644
index 0000000..aa9b608
--- /dev/null
+++ b/cmd/init_test.go
@@ -0,0 +1,133 @@
+package cmd
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/encodeous/nylon/state"
+	"github.com/goccy/go-yaml"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestInitCommandCreatesValidConfig(t *testing.T) {
+	output := filepath.Join(t.TempDir(), "node.yaml")
+	cmd := newInitCmd()
+	cmd.SetIn(strings.NewReader(""))
+	var stdout bytes.Buffer
+	cmd.SetOut(&stdout)
+	cmd.SetArgs([]string{
+		"--id", "router-1",
+		"--output", output,
+		"--dns-resolver", "1.1.1.1:53",
+		"--exclude-ip", "192.168.0.0/24",
+		"--interface-name", "nylon-test",
+	})
+
+	require.NoError(t, cmd.Execute())
+
+	data, err := os.ReadFile(output)
+	require.NoError(t, err)
+	var cfg state.LocalCfg
+	require.NoError(t, yaml.Unmarshal(data, &cfg))
+	require.NoError(t, state.NodeConfigValidator(nil, &cfg))
+	assert.Equal(t, state.NodeId("router-1"), cfg.Id)
+	assert.Equal(t, uint16(57175), cfg.Port)
+	assert.Equal(t, []string{"1.1.1.1:53"}, cfg.DnsResolvers)
+	assert.Equal(t, "nylon-test", cfg.InterfaceName)
+	assert.NotContains(t, stdout.String(), "Interactive node configuration")
+
+	info, err := os.Stat(output)
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+}
+
+func TestInitCommandPromptsForUnsetOptions(t *testing.T) {
+	output := filepath.Join(t.TempDir(), "interactive-node.yaml")
+	input := strings.Join([]string{
+		"INVALID ID",
+		"router-interactive",
+		"0",
+		"60000",
+		output,
+		"",
+		"yes",
+		"yes",
+		"no",
+		"1.1.1.1:53, 8.8.8.8:53",
+		"nylon-test",
+		"/var/log/nylon.log",
+		"no",
+		"10.0.0.0/8",
+		"192.168.0.0/24",
+		"echo pre-up",
+		"echo pre-down",
+		"echo post-up",
+		"echo post-down",
+	}, "\n") + "\n"
+
+	cmd := newInitCmd()
+	cmd.SetIn(strings.NewReader(input))
+	var stdout bytes.Buffer
+	cmd.SetOut(&stdout)
+
+	require.NoError(t, cmd.Execute())
+
+	data, err := os.ReadFile(output)
+	require.NoError(t, err)
+	var cfg state.LocalCfg
+	require.NoError(t, yaml.Unmarshal(data, &cfg))
+	assert.Equal(t, state.NodeId("router-interactive"), cfg.Id)
+	assert.Equal(t, uint16(60000), cfg.Port)
+	assert.True(t, cfg.UseSystemRouting)
+	assert.False(t, cfg.NoNetConfigure)
+	assert.Equal(t, []string{"1.1.1.1:53", "8.8.8.8:53"}, cfg.DnsResolvers)
+	assert.Equal(t, "nylon-test", cfg.InterfaceName)
+	assert.Equal(t, "/var/log/nylon.log", cfg.LogPath)
+	require.Len(t, cfg.UnexcludeIPs, 1)
+	assert.Equal(t, "10.0.0.0/8", cfg.UnexcludeIPs[0].String())
+	require.Len(t, cfg.ExcludeIPs, 1)
+	assert.Equal(t, "192.168.0.0/24", cfg.ExcludeIPs[0].String())
+	assert.Equal(t, []string{"echo pre-up"}, cfg.PreUp)
+	assert.Equal(t, []string{"echo pre-down"}, cfg.PreDown)
+	assert.Equal(t, []string{"echo post-up"}, cfg.PostUp)
+	assert.Equal(t, []string{"echo post-down"}, cfg.PostDown)
+	assert.Contains(t, stdout.String(), "Interactive node configuration")
+	assert.Contains(t, stdout.String(), "Invalid node ID")
+	assert.Contains(t, stdout.String(), "Port must be a number between 1 and 65535")
+	assert.Contains(t, stdout.String(), "Created "+output)
+}
+
+func TestInitCommandRefusesToOverwrite(t *testing.T) {
+	output := filepath.Join(t.TempDir(), "node.yaml")
+	require.NoError(t, os.WriteFile(output, []byte("existing"), 0o600))
+
+	cmd := newInitCmd()
+	cmd.SetArgs([]string{"--id", "router-1", "--output", output})
+	err := cmd.Execute()
+	require.ErrorContains(t, err, "already exists")
+
+	data, readErr := os.ReadFile(output)
+	require.NoError(t, readErr)
+	assert.Equal(t, "existing", string(data))
+}
+
+func TestBuildNodeConfigRequiresCompleteDistributionConfig(t *testing.T) {
+	_, err := buildNodeConfig(initOptions{
+		id:      "router-1",
+		port:    57175,
+		distURL: "https://example.com/central.nybundle",
+	})
+	require.ErrorContains(t, err, "--dist-url and --dist-key")
+}
+
+func TestBuildNodeConfigRejectsInvalidValues(t *testing.T) {
+	_, err := buildNodeConfig(initOptions{id: "INVALID ID", port: 57175})
+	require.ErrorContains(t, err, "invalid node config")
+
+	_, err = buildNodeConfig(initOptions{id: "router-1", port: 57175, excludeIPs: []string{"not-a-prefix"}})
+	require.ErrorContains(t, err, "invalid --exclude-ip")
+}
diff --git a/docs/guides/getting-started.mdx b/docs/guides/getting-started.mdx
index 21d80b2..625eba5 100644
--- a/docs/guides/getting-started.mdx
+++ b/docs/guides/getting-started.mdx
@@ -25,38 +25,34 @@ The Linux and macOS versions are well tested, but the Windows TUN interface has
 
 <Steps>
 
-1. ### Generate Keypairs
+1. ### Create Node Configuration
 
-   On each node, generate a WireGuard keypair:
+   On each node, generate `node.yaml` and a WireGuard keypair:
 
    ```bash
-   nylon key
+   nylon init
    ```
 
-   This will output two keys (example):
-
-   ```
-   kPoLiC4+Nh9AoQGiBmJTh+8BUqCMsa6Zdr4M0Xz5bX0=
-   9Z1HGi7eip6GdQezqy3Vc7Er76ZgTfryda9wvHUgWzk=
-   ```
-
-   The first key (stdout) is your private key, and the second key (stderr) is your public key. Keep the private key safe, and note down the public key for the next step.
+   The interactive setup asks for a unique node ID and other common settings.
+   It writes the private key to a user-readable-only config file and prints the
+   public key for the central configuration. Advanced network, DNS,
+   distribution, and hook settings are available from the same setup flow.
 
    :::tip
-   If you already have a WireGuard keypair, you can use that interchangeably with nylon.
+   For automated setup, pass the node ID and any other settings as flags, such
+   as `nylon init --id node-1`. Pass an existing WireGuard private key with
+   `--key`, or use `nylon key` when you only need to generate a keypair.
    :::
 
-2. ### Create Node Configuration
-
-   On each node, create a `node.yaml` file. Replace `<YOUR_PRIVATE_KEY>` with the private key generated in step 1.
+   The generated file contains:
 
    ```yaml title="node.yaml"
-   id: node-1 # Give each node a unique ID (e.g., node-1, node-2)
-   key: <YOUR_PRIVATE_KEY>
+   key: <GENERATED_PRIVATE_KEY>
+   id: node-1
    port: 57175
    ```
 
-3. ### Create Central Configuration
+2. ### Create Central Configuration
 
    The `central.yaml` file defines the topology of your network. Create one file and share it across all nodes.
 
@@ -109,4 +105,4 @@ The Linux and macOS versions are well tested, but the Windows TUN interface has
 - Setup nylon without a static public IP using [Dynamic DNS & Port Forwarding](/guides/port-forward).
 - Monitor your nodes with [Prometheus metrics and health checks](/guides/observability).
 {/* TODO: Advanced Routing guide (Anycast, Prefix Healthchecks) */}
-{/* TODO: Monitoring and Debugging guide */}
\ No newline at end of file
+{/* TODO: Monitoring and Debugging guide */}
diff --git a/state/serialize.go b/state/serialize.go
index 752f5cf..ed4cdd6 100644
--- a/state/serialize.go
+++ b/state/serialize.go
@@ -3,6 +3,8 @@ package state
 import (
 	"encoding/base64"
 	"fmt"
+
+	"github.com/encodeous/nylon/polyamide/device"
 )
 
 func (k NyPrivateKey) MarshalText() ([]byte, error) {
@@ -16,6 +18,9 @@ func (k *NyPrivateKey) UnmarshalText(text []byte) error {
 	if err != nil {
 		return fmt.Errorf("failed to decode private key: %w", err)
 	}
+	if len(data) != device.NoisePrivateKeySize {
+		return fmt.Errorf("private key must decode to %d bytes, got %d", device.NoisePrivateKeySize, len(data))
+	}
 	*k = NyPrivateKey(data)
 	return nil
 }
@@ -24,6 +29,9 @@ func (k *NyPublicKey) UnmarshalText(text []byte) error {
 	if err != nil {
 		return fmt.Errorf("failed to decode public key (%s): %w", text, err)
 	}
+	if len(data) != device.NoisePublicKeySize {
+		return fmt.Errorf("public key must decode to %d bytes, got %d", device.NoisePublicKeySize, len(data))
+	}
 	*k = NyPublicKey(data)
 	return nil
 }
diff --git a/state/serialize_test.go b/state/serialize_test.go
index cc8cb0a..041d523 100644
--- a/state/serialize_test.go
+++ b/state/serialize_test.go
@@ -38,3 +38,11 @@ port: abcd
 	err := yaml.Unmarshal([]byte(x1), &y1)
 	assert.ErrorContains(t, err, "cannot unmarshal string")
 }
+
+func TestDeserializeRejectsWrongKeyLength(t *testing.T) {
+	var privateKey NyPrivateKey
+	assert.ErrorContains(t, privateKey.UnmarshalText([]byte("c2hvcnQ=")), "must decode to 32 bytes")
+
+	var publicKey NyPublicKey
+	assert.ErrorContains(t, publicKey.UnmarshalText([]byte("c2hvcnQ=")), "must decode to 32 bytes")
+}