diff --git a/common.go b/common.go
index 44232ed..842a32f 100644
--- a/common.go
+++ b/common.go
@@ -71,7 +71,7 @@ const (
 	maxHandshake               = 65536        // maximum handshake we support (protocol max is 16 MB)
 	maxHandshakeCertificateMsg = 262144       // maximum certificate message size (256 KiB)
 	//////////////////////////////////// [REALITY] SECTION: change maxUselessRecords to match with OpenSSL
-	maxUselessRecords          = 32           // maximum number of consecutive non-advancing records
+	maxUselessRecords = 32 // maximum number of consecutive non-advancing records
 	//////////////////////////////////// [REALITY] SECTION END
 )
 
@@ -573,7 +573,7 @@ const (
 	RenegotiateFreelyAsClient
 )
 
-//////////////////////////////////// [REALITY] SECTION: define var
+// ////////////////////////////////// [REALITY] SECTION: define var
 type LimitFallback struct {
 	AfterBytes       uint64
 	BytesPerSec      uint64
@@ -599,11 +599,11 @@ type Config struct {
 	MaxTimeDiff  time.Duration
 	ShortIds     map[[8]byte]bool
 
-	Mldsa65Key []byte
+	Mldsa65Key *mldsa.PrivateKey
 
 	LimitFallbackUpload   LimitFallback
 	LimitFallbackDownload LimitFallback
-//////////////////////////////////// [REALITY] SECTION END
+	//////////////////////////////////// [REALITY] SECTION END
 
 	// Rand provides the source of entropy for the connection.
 	// If Rand is nil, TLS uses the cryptographic random reader in package
@@ -1043,21 +1043,22 @@ func (c *Config) Clone() *Config {
 	c.mutex.RLock()
 	defer c.mutex.RUnlock()
 	return &Config{
-//////////////////////////////////// [REALITY] SECTION: define var
-		DialContext:                         c.DialContext,
-		Show:                                c.Show,
-		Type:                                c.Type,
-		Dest:                                c.Dest,
-		Xver:                                c.Xver,
-		ServerNames:                         c.ServerNames,
-		PrivateKey:                          c.PrivateKey,
-		MinClientVer:                        c.MinClientVer,
-		MaxClientVer:                        c.MaxClientVer,
-		MaxTimeDiff:                         c.MaxTimeDiff,
-		ShortIds:                            c.ShortIds,
-		LimitFallbackUpload:                 c.LimitFallbackUpload,
-		LimitFallbackDownload:               c.LimitFallbackDownload,
-//////////////////////////////////// [REALITY] SECTION END
+		//////////////////////////////////// [REALITY] SECTION: define var
+		DialContext:           c.DialContext,
+		Show:                  c.Show,
+		Type:                  c.Type,
+		Dest:                  c.Dest,
+		Xver:                  c.Xver,
+		ServerNames:           c.ServerNames,
+		PrivateKey:            c.PrivateKey,
+		MinClientVer:          c.MinClientVer,
+		MaxClientVer:          c.MaxClientVer,
+		MaxTimeDiff:           c.MaxTimeDiff,
+		ShortIds:              c.ShortIds,
+		Mldsa65Key:            c.Mldsa65Key,
+		LimitFallbackUpload:   c.LimitFallbackUpload,
+		LimitFallbackDownload: c.LimitFallbackDownload,
+		//////////////////////////////////// [REALITY] SECTION END
 		Rand:                                c.Rand,
 		Time:                                c.Time,
 		Certificates:                        c.Certificates,
diff --git a/handshake_server_tls13.go b/handshake_server_tls13.go
index 3e73cb6..7db1cf2 100644
--- a/handshake_server_tls13.go
+++ b/handshake_server_tls13.go
@@ -12,7 +12,6 @@ import (
 	"crypto/hkdf"
 	"crypto/hmac"
 	"crypto/hpke"
-	"crypto/mldsa"
 	"crypto/mlkem"
 	"crypto/rand"
 	"crypto/rsa"
@@ -71,7 +70,7 @@ type serverHandshakeStateTLS13 struct {
 	echContext      *echServerContext
 }
 
-//////////////////////////////////// [REALITY] SECTION: do handshake
+// ////////////////////////////////// [REALITY] SECTION: do handshake
 var (
 	ed25519Priv       ed25519.PrivateKey
 	signedCert        []byte
@@ -91,7 +90,7 @@ func (hs *serverHandshakeStateTLS13) handshake() error {
 	if c.config.Show {
 		remoteAddr := c.RemoteAddr().String()
 		fmt.Printf("REALITY remoteAddr: %v\tis using X25519MLKEM768 for TLS' communication: %v\n", remoteAddr, hs.hello.serverShare.group == X25519MLKEM768)
-		fmt.Printf("REALITY remoteAddr: %v\tis using ML-DSA-65 for cert's extra signature: %v\n", remoteAddr, len(c.config.Mldsa65Key) > 0)
+		fmt.Printf("REALITY remoteAddr: %v\tis using ML-DSA-65 for cert's extra signature: %v\n", remoteAddr, c.config.Mldsa65Key != nil)
 	}
 	// For an overview of the TLS 1.3 handshake, see RFC 8446, Section 2.
 	/*
@@ -141,7 +140,7 @@ func (hs *serverHandshakeStateTLS13) handshake() error {
 	*/
 	{
 		var cert []byte
-		if len(c.config.Mldsa65Key) > 0 {
+		if c.config.Mldsa65Key != nil {
 			cert = bytes.Clone(signedCertMldsa65)
 		} else {
 			cert = bytes.Clone(signedCert)
@@ -151,17 +150,15 @@ func (hs *serverHandshakeStateTLS13) handshake() error {
 		h.Write(ed25519Priv[32:])
 		h.Sum(cert[:len(cert)-64])
 
-		if len(c.config.Mldsa65Key) > 0 {
+		if c.config.Mldsa65Key != nil {
 			h.Write(hs.clientHello.original)
 			h.Write(hs.hello.original)
-			key, err := mldsa.NewPrivateKey(mldsa.MLDSA65(), c.config.Mldsa65Key)
+			sig, err := c.config.Mldsa65Key.SignDeterministic(h.Sum(nil), nil)
 			if err != nil {
-				return errors.New("invalid ML-DSA-65 private key: " + err.Error())
+				return errors.New("failed to sign with ML-DSA-65 key: " + err.Error())
 			}
-			sig, _ := key.SignDeterministic(h.Sum(nil), nil)
 			copy(cert[126:], sig) // fixed location
 		}
-
 		hs.cert = &Certificate{
 			Certificate: [][]byte{cert},
 			PrivateKey:  ed25519Priv,
@@ -202,6 +199,7 @@ func (hs *serverHandshakeStateTLS13) handshake() error {
 
 	return nil
 }
+
 //////////////////////////////////// [REALITY] SECTION END
 
 func (hs *serverHandshakeStateTLS13) processClientHello() error {