diff --git a/crates/keyfork-shard/src/bin/keyfork-shard-combine-openpgp.rs b/crates/keyfork-shard/src/bin/keyfork-shard-combine-openpgp.rs
index 5e5338f..f910647 100644
--- a/crates/keyfork-shard/src/bin/keyfork-shard-combine-openpgp.rs
+++ b/crates/keyfork-shard/src/bin/keyfork-shard-combine-openpgp.rs
@@ -32,9 +32,7 @@ fn run() -> Result<()> {
     };
 
     let openpgp = OpenPGP;
-
     let bytes = openpgp.decrypt_all_shards_to_secret(key_discovery, messages_file)?;
-
     print!("{}", smex::encode(&bytes));
 
     Ok(())
diff --git a/crates/keyfork/src/cli/recover.rs b/crates/keyfork/src/cli/recover.rs
index d68a193..3b766b2 100644
--- a/crates/keyfork/src/cli/recover.rs
+++ b/crates/keyfork/src/cli/recover.rs
@@ -3,10 +3,7 @@ use clap::{Parser, Subcommand};
 use std::path::PathBuf;
 
 use keyfork_mnemonic_util::{English, Mnemonic};
-use keyfork_shard::{
-    openpgp::{combine, discover_certs, parse_messages},
-    remote_decrypt,
-};
+use keyfork_shard::{remote_decrypt, Format};
 
 type Result<T, E = Box<dyn std::error::Error>> = std::result::Result<T, E>;
 
@@ -37,15 +34,10 @@ impl RecoverSubcommands {
             } => {
                 let content = std::fs::read_to_string(shard_file)?;
                 if content.contains("BEGIN PGP MESSAGE") {
-                    let certs = key_discovery
-                        .as_ref()
-                        .map(discover_certs)
-                        .transpose()?
-                        .unwrap_or(vec![]);
-                    let mut messages = parse_messages(content.as_bytes())?;
-                    let metadata = messages.pop_front().expect("any pgp encrypted message");
-                    let mut seed = vec![];
-                    combine(certs, &metadata, messages.into(), &mut seed)?;
+                    let openpgp = keyfork_shard::openpgp::OpenPGP;
+                    // TODO: remove .clone() by making handle() consume self
+                    let seed = openpgp
+                        .decrypt_all_shards_to_secret(key_discovery.clone(), content.as_bytes())?;
                     Ok(seed)
                 } else {
                     panic!("unknown format of shard file");
diff --git a/crates/keyfork/src/cli/shard.rs b/crates/keyfork/src/cli/shard.rs
index 6439b5f..ee8d741 100644
--- a/crates/keyfork/src/cli/shard.rs
+++ b/crates/keyfork/src/cli/shard.rs
@@ -1,5 +1,6 @@
 use super::Keyfork;
 use clap::{builder::PossibleValue, Parser, Subcommand, ValueEnum};
+use keyfork_shard::Format as _;
 use std::{
     io::{stdin, stdout, Read, Write},
     path::{Path, PathBuf},
@@ -86,25 +87,8 @@ impl ShardExec for OpenPGP {
     where
         T: AsRef<Path>,
     {
-        let certs = key_discovery
-            .map(|kd| keyfork_shard::openpgp::discover_certs(kd.as_ref()))
-            .transpose()?
-            .unwrap_or(vec![]);
-
-        let mut encrypted_messages = keyfork_shard::openpgp::parse_messages(input)?;
-        let encrypted_metadata = encrypted_messages
-            .pop_front()
-            .expect("any pgp encrypted message");
-
-        let mut bytes = vec![];
-
-        keyfork_shard::openpgp::combine(
-            certs,
-            &encrypted_metadata,
-            encrypted_messages.into(),
-            &mut bytes,
-        )?;
-
+        let openpgp = keyfork_shard::openpgp::OpenPGP;
+        let bytes = openpgp.decrypt_all_shards_to_secret(key_discovery, input)?;
         write!(output, "{}", smex::encode(&bytes))?;
 
         Ok(())
@@ -118,21 +102,8 @@ impl ShardExec for OpenPGP {
     where
         T: AsRef<Path>,
     {
-        let certs = key_discovery
-            .map(|kd| keyfork_shard::openpgp::discover_certs(kd.as_ref()))
-            .transpose()?
-            .unwrap_or(vec![]);
-
-        let mut encrypted_messages = keyfork_shard::openpgp::parse_messages(input)?;
-        let encrypted_metadata = encrypted_messages
-            .pop_front()
-            .expect("any pgp encrypted message");
-
-        keyfork_shard::openpgp::decrypt(
-            &certs,
-            &encrypted_metadata,
-            encrypted_messages.make_contiguous(),
-        )?;
+        let openpgp = keyfork_shard::openpgp::OpenPGP;
+        openpgp.decrypt_one_shard_for_transport(key_discovery, input)?;
         Ok(())
     }
 }