diff --git a/src/or/main.c b/src/or/main.c
index b3898fff39..759487c0ae 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -763,6 +763,13 @@ static int do_main_loop(void) {
   /* Intialize the service cache. */
   rend_cache_init();
 
+  /* load the private keys, if we're supposed to have them, and set up the
+   * TLS context. */
+  if (init_keys() < 0 || rend_service_load_keys() < 0) {
+    log_fn(LOG_ERR,"Error initializing keys; exiting");
+    return -1;
+  }
+
   /* load the routers file */
   if(options.RouterFile) {
     routerlist_clear_trusted_directories();
@@ -772,13 +779,6 @@ static int do_main_loop(void) {
     }
   }
 
-  /* load the private keys, if we're supposed to have them, and set up the
-   * TLS context. */
-  if (init_keys() < 0 || rend_service_load_keys() < 0) {
-    log_fn(LOG_ERR,"Error initializing keys; exiting");
-    return -1;
-  }
-
   if(authdir_mode()) {
     /* the directory is already here, run startup things */
     directory_has_arrived();
diff --git a/src/or/router.c b/src/or/router.c
index c0f3cbce6d..f28778f0e3 100644
--- a/src/or/router.c
+++ b/src/or/router.c
@@ -509,8 +509,7 @@ int router_rebuild_descriptor(void) {
   ri->bandwidthburst = options.BandwidthBurst;
   ri->exit_policy = NULL; /* zero it out first */
   router_add_exit_policy_from_config(ri);
-  ri->is_trusted_dir = (ri->dir_port &&
-    router_digest_is_trusted_dir(ri->identity_digest));
+  ri->is_trusted_dir = authdir_mode();
   if (desc_routerinfo)
     routerinfo_free(desc_routerinfo);
   desc_routerinfo = ri;
diff --git a/src/or/routerlist.c b/src/or/routerlist.c
index 95b0a033cd..7f8e466416 100644
--- a/src/or/routerlist.c
+++ b/src/or/routerlist.c
@@ -310,6 +310,7 @@ routerinfo_t *router_get_by_nickname(const char *nickname)
   return NULL;
 }
 
+/* XXX008 currently this trusted_dir_digests stuff is not used. */
 /** Return true iff <b>digest</b> is the digest of the identity key of
  * a trusted directory. */
 int router_digest_is_trusted_dir(const char *digest) {