diff --git a/nodeup/pkg/model/fakes_test.go b/nodeup/pkg/model/fakes_test.go
index 4c04240c5b..f53316e6a8 100644
--- a/nodeup/pkg/model/fakes_test.go
+++ b/nodeup/pkg/model/fakes_test.go
@@ -94,10 +94,6 @@ func (k fakeCAStore) FindCertificatePool(name string) (*fi.CertificatePool, erro
 	panic("fakeCAStore does not implement FindCertificatePool")
 }
 
-func (k fakeCAStore) FindCertificateKeyset(name string) (*kops.Keyset, error) {
-	panic("fakeCAStore does not implement FindCertificateKeyset")
-}
-
 func (k fakeCAStore) FindPrivateKey(name string) (*pki.PrivateKey, error) {
 	primaryId := k.privateKeysets[name].Spec.PrimaryId
 	for _, item := range k.privateKeysets[name].Spec.Keys {
@@ -108,10 +104,6 @@ func (k fakeCAStore) FindPrivateKey(name string) (*pki.PrivateKey, error) {
 	return nil, nil
 }
 
-func (k fakeCAStore) FindPrivateKeyset(name string) (*kops.Keyset, error) {
-	return k.privateKeysets[name], nil
-}
-
 func (k fakeCAStore) FindCert(name string) (*pki.Certificate, error) {
 	return k.certs[name], nil
 }
diff --git a/pkg/configserver/keystore.go b/pkg/configserver/keystore.go
index e6e1d7ba37..37eff09c6f 100644
--- a/pkg/configserver/keystore.go
+++ b/pkg/configserver/keystore.go
@@ -73,21 +73,11 @@ func (s *configserverKeyStore) FindCertificatePool(name string) (*fi.Certificate
 	return nil, fmt.Errorf("FindCertificatePool not supported by configserverKeyStore")
 }
 
-// FindCertificateKeyset implements fi.CAStore
-func (s *configserverKeyStore) FindCertificateKeyset(name string) (*kops.Keyset, error) {
-	return nil, fmt.Errorf("FindCertificateKeyset not supported by configserverKeyStore")
-}
-
 // FindPrivateKey implements fi.CAStore
 func (s *configserverKeyStore) FindPrivateKey(name string) (*pki.PrivateKey, error) {
 	return nil, fmt.Errorf("FindPrivateKey not supported by configserverKeyStore")
 }
 
-// FindPrivateKeyset implements fi.CAStore
-func (s *configserverKeyStore) FindPrivateKeyset(name string) (*kops.Keyset, error) {
-	return nil, fmt.Errorf("FindPrivateKeyset not supported by configserverKeyStore")
-}
-
 // FindCert implements fi.CAStore
 func (s *configserverKeyStore) FindCert(name string) (*pki.Certificate, error) {
 	for _, cert := range s.nodeConfig.Certificates {
diff --git a/upup/pkg/fi/ca.go b/upup/pkg/fi/ca.go
index ffdb5f6ae4..9642c9dab7 100644
--- a/upup/pkg/fi/ca.go
+++ b/upup/pkg/fi/ca.go
@@ -88,15 +88,9 @@ type CAStore interface {
 	// FindCertificatePool returns the named CertificatePool, or (nil,nil) if not found
 	FindCertificatePool(name string) (*CertificatePool, error)
 
-	// FindCertificateKeyset will return the keyset for a certificate
-	FindCertificateKeyset(name string) (*kops.Keyset, error)
-
 	// FindPrivateKey returns the named private key, or (nil,nil) if not found
 	FindPrivateKey(name string) (*pki.PrivateKey, error)
 
-	// FindPrivateKeyset will return the keyset for a private key
-	FindPrivateKeyset(name string) (*kops.Keyset, error)
-
 	// FindCert returns the specified certificate, if it exists, or nil if not found
 	FindCert(name string) (*pki.Certificate, error)
 
diff --git a/upup/pkg/fi/clientset_castore.go b/upup/pkg/fi/clientset_castore.go
index 859234aec5..3cbe9cb0c3 100644
--- a/upup/pkg/fi/clientset_castore.go
+++ b/upup/pkg/fi/clientset_castore.go
@@ -197,19 +197,6 @@ func (c *ClientsetCAStore) FindCertificatePool(name string) (*CertificatePool, e
 	return pool, nil
 }
 
-// FindCertificateKeyset implements CAStore::FindCertificateKeyset
-func (c *ClientsetCAStore) FindCertificateKeyset(name string) (*kops.Keyset, error) {
-	ctx := context.TODO()
-	o, err := c.clientset.Keysets(c.namespace).Get(ctx, name, metav1.GetOptions{})
-	if err != nil {
-		if errors.IsNotFound(err) {
-			return nil, nil
-		}
-		return nil, fmt.Errorf("error reading keyset %q: %v", name, err)
-	}
-	return o, nil
-}
-
 // ListKeysets implements CAStore::ListKeysets
 func (c *ClientsetCAStore) ListKeysets() ([]*kops.Keyset, error) {
 	ctx := context.TODO()
@@ -278,19 +265,6 @@ func (c *ClientsetCAStore) FindPrivateKey(name string) (*pki.PrivateKey, error)
 	return nil, nil
 }
 
-// FindPrivateKeyset implements CAStore::FindPrivateKeyset
-func (c *ClientsetCAStore) FindPrivateKeyset(name string) (*kops.Keyset, error) {
-	ctx := context.TODO()
-	o, err := c.clientset.Keysets(c.namespace).Get(ctx, name, metav1.GetOptions{})
-	if err != nil {
-		if errors.IsNotFound(err) {
-			return nil, nil
-		}
-		return nil, fmt.Errorf("error reading keyset %q: %v", name, err)
-	}
-	return o, nil
-}
-
 // storeKeyset saves the specified keyset to the registry.
 func (c *ClientsetCAStore) storeKeyset(ctx context.Context, name string, keyset *Keyset, keysetType kops.KeysetType) error {
 	create := false
diff --git a/upup/pkg/fi/vfs_castore.go b/upup/pkg/fi/vfs_castore.go
index 6f69fd5a02..d921ea54bf 100644
--- a/upup/pkg/fi/vfs_castore.go
+++ b/upup/pkg/fi/vfs_castore.go
@@ -320,25 +320,6 @@ func (c *VFSCAStore) FindCertificatePool(name string) (*CertificatePool, error)
 	return pool, nil
 }
 
-func (c *VFSCAStore) FindCertificateKeyset(name string) (*kops.Keyset, error) {
-	p := c.buildCertificatePoolPath(name)
-	certs, err := c.loadKeyset(p)
-	if err != nil {
-		return nil, fmt.Errorf("error in 'FindCertificatePool' attempting to load cert %q: %v", name, err)
-	}
-
-	if certs == nil {
-		return nil, nil
-	}
-
-	o, err := certs.ToAPIObject(name, false)
-	if err != nil {
-		return nil, err
-	}
-
-	return o, nil
-}
-
 // ListKeysets implements CAStore::ListKeysets
 func (c *VFSCAStore) ListKeysets() ([]*kops.Keyset, error) {
 	keysets := make(map[string]*kops.Keyset)
@@ -606,20 +587,6 @@ func (c *VFSCAStore) FindPrivateKey(id string) (*pki.PrivateKey, error) {
 	return key, nil
 }
 
-func (c *VFSCAStore) FindPrivateKeyset(name string) (*kops.Keyset, error) {
-	keys, err := c.findPrivateKeyset(name)
-	if err != nil {
-		return nil, err
-	}
-
-	o, err := keys.ToAPIObject(name, true)
-	if err != nil {
-		return nil, err
-	}
-
-	return o, nil
-}
-
 func (c *VFSCAStore) deletePrivateKey(name string, id string) (bool, error) {
 	// Delete the file itself
 	{