diff --git a/ChangeLog b/ChangeLog
index cf09107..5f74291 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -58,6 +58,16 @@
 	c and yaml code. A programmer can use this to
 	put a public key in a small program.
 
+	Finally found the bug that leaded to the unittests
+	sometimes fail as previously described in the TODO
+	file: the function libpcp/z85.c:_buffer_is_binary()
+	shall return a non-zero value if it finds a binary
+	character in the input. However, if the first char
+	of the input was binary it returned 0, which was then
+	interpreted later such that the input is ascii.
+	To fix this, the function now starts at position 1
+	to search.
+
 0.2.0	ED25519 and Curve25519 keys are now generated
 	separately (previously they were generated from
 	one random seed, the curve had been derived from
diff --git a/TODO b/TODO
index f3719d0..f2c4f5a 100644
--- a/TODO
+++ b/TODO
@@ -17,19 +17,6 @@ vault checksum: add keysigs as well
 
 enable formats for secret key exports as well
 
-Unitttests:
-  - sometimes "no matching pub key in vault, while it's there
-    Cause:
-      echo HALLO | ../src/pcp1 -V vcl -e -O testencrypted -i 0xA907B927849B39F9
-        ok 28 - check-crypto-unencrypted-secret-message
-      public key exported.  <=== ???
-
-  - sometimes secret key is empty
-
-  Possible causes: the unittest segfaults and unittest.pl doesn't
-  catch it, esp. if the prepare call segfaults. Or, there's some bug
-  in unittest.pl, however the issue started as I switched to the
-  pcpstream api.
 
 
 Python binding, e.g.:
diff --git a/libpcp/mgmt.c b/libpcp/mgmt.c
index 92d1812..c7f907e 100644
--- a/libpcp/mgmt.c
+++ b/libpcp/mgmt.c
@@ -184,6 +184,7 @@ pcp_ks_bundle_t *pcp_import_pub(unsigned char *raw, size_t rawsize) {
 
   /* first, try to decode the input */
   z85 = pcp_readz85string(raw, rawsize);
+
   if(z85 != NULL)
     bin = pcp_z85_decode(z85, &clen);
 
diff --git a/libpcp/z85.c b/libpcp/z85.c
index 55e351c..8095eaa 100644
--- a/libpcp/z85.c
+++ b/libpcp/z85.c
@@ -24,7 +24,9 @@
 
 size_t _buffer_is_binary(unsigned char *buf, size_t len) {
   size_t pos;
-  for (pos=0; pos<len; ++pos) {
+  /* start at 1, to circumvent returning 0 if we find a match at position 0,
+     which would lead the caller to believe the buffer is not binary */
+  for (pos=1; pos<len; ++pos) {
     if(buf[pos] == '\0' || (buf[pos] != '\r' && buf[pos] != '\n' && isprint(buf[pos]) == 0)) {
       break;
     }
diff --git a/tests/unittests.cfg b/tests/unittests.cfg
index 6bd6a42..9545418 100644
--- a/tests/unittests.cfg
+++ b/tests/unittests.cfg
@@ -189,26 +189,47 @@ temporarily disabled
 
 #
 # check usage of unencrypted secret key
-<test check-crypto-unencrypted-secret>
-  cmd = (echo dau; echo foo; echo yes) | $pcp -V vcl -k -x "n/a"
-  expect = /added to/
-</test>
+<test vcl>
+  prepare = rm -f vb2 vcl
+  <test check-vcl-crypto-unencrypted-secret>
+    cmd = (echo dau; echo foo; echo yes) | $pcp -V vcl -k -x "n/a"
+    expect = /added to/
+  </test>
+  
+  <test check-vcl-crypto-unencrypted-secret-yaml>
+    cmd = $pcp -V vcl -y
+    expect = /encrypted:  no/
+  </test>
 
-<test check-crypto-unencrypted-secret-yaml>
-  cmd = $pcp -V vcl -y
-  expect = /encrypted:  no/
-</test>
+  <test check-vcl-prepare-import-bpub>
+    cmd = $pcp -V vcl -I key-bobby-pub -P
+    expect = /added/
+  </test>
 
-<test check-crypto-unencrypted-secret-message>
-  prepare = $pcp -V vcl -I key-bobby-pub -P
-  cmd     = echo HALLO | $pcp -V vcl -e -O testencrypted -i ${idbobby}
-  expect  = /success/
-</test>
+  <test check-vcl-export-unencrypted-pubkey>
+    cmd = $pcp -V vcl -p -O testkeyvcl
+    expect = /exported/
+  </test>
 
-<test check-crypto-unencrypted-secret-read>
-  prepare = $pcp -V vcl -p | $pcp -V vb -P
-  cmd = $pcp -V vb -d -I testencrypted -x b
-  expect  = /HALLO/
+  <test check-vcl-import-bsecret>
+    cmd = $pcp -V vb2 -S -I key-bobby-sec -x b
+    expect = /${idbobby}/
+  </test>
+
+  <test check-vcl-import-unencrypted-pubkey>
+    cmd =  $pcp -V vb2 -P -I testkeyvcl
+    expect = /added/
+  </test>
+
+  <test check-vcl-crypto-unencrypted-secret-message>
+    cmd     = echo HALLO | $pcp -V vcl -e -O testencrypted -i ${idbobby}
+    expect  = /success/
+  </test>
+
+  <test check-vcl-crypto-unencrypted-secret-read>
+    cmd = $pcp -V vb2 -d -I testencrypted -x b
+    expect  = /HALLO/
+  </test>
 </test>
 
 #