diff --git a/TODO b/TODO
index 968b6a3..a323545 100644
--- a/TODO
+++ b/TODO
@@ -4,9 +4,6 @@ allow signing using an alternate secret key, like in pcpdecrypt()
 
 malloc() new pointers in functions only if not NULL, e.g. pcp_gennonce()
 
-generalize file i/0, open+close only in src/, print msg if using stdin or stdout
-  - sign + crypt done. key exports und imports to follow
-
 check pub key count in pcp.c before calling verify signature, croak if count==0
 
 Update pod key format spec.
@@ -47,6 +44,8 @@ Z85 headers:
 Check is_utf8 license.
   also found in https://gd.meizo.com/_files/lpc/ext/utf8.c
 
+Vault checksum with global vault
+
 Python binding, e.g.:
 py % cdll.LoadLibrary("libsodium.so.8")
 <CDLL 'libsodium.so.8', handle 800776c00 at 80192a3d0>
diff --git a/configure.ac b/configure.ac
index c895615..fc28e95 100755
--- a/configure.ac
+++ b/configure.ac
@@ -282,7 +282,7 @@ if test -n "$bigendian"; then
     CFLAGS="$CFLAGS -D__CPU_IS_BIG_ENDIAN=1"
 fi
 
-CFLAGS="$CFLAGS -Werror -Wextra"
+CFLAGS="$CFLAGS -Werror -Wextra -O2"
 CXXFLAGS="$CFLAGS"
 
 AC_SUBST(PACKAGE_VERSION)