diff --git a/router/overlay.go b/router/overlay.go
index 1789f886..e0e95364 100644
--- a/router/overlay.go
+++ b/router/overlay.go
@@ -61,13 +61,6 @@ type ForwarderParams struct {
 // to decode the frame.
 type OverlayConsumer func(ForwardPacketKey) FlowOp
 
-// Crypto settings for a forwarder.
-type OverlayCrypto struct {
-	Dec   Decryptor
-	Enc   Encryptor
-	EncDF Encryptor
-}
-
 // All of the machinery to forward packets to a particular peer
 type OverlayForwarder interface {
 	// Forward a packet across the connection.  May be called as
diff --git a/router/sleeve.go b/router/sleeve.go
index 01001b3f..cc6694ec 100644
--- a/router/sleeve.go
+++ b/router/sleeve.go
@@ -273,6 +273,12 @@ func (sleeve *SleeveOverlay) send(msg []byte, raddr *net.UDPAddr) error {
 	return err
 }
 
+type sleeveCrypto struct {
+	Dec   Decryptor
+	Enc   Encryptor
+	EncDF Encryptor
+}
+
 type sleeveForwarder struct {
 	// Immutable
 	sleeve         *SleeveOverlay
@@ -303,7 +309,7 @@ type sleeveForwarder struct {
 	stackFrag bool
 
 	// State only used within the forwarder goroutine
-	crypto     OverlayCrypto
+	crypto     sleeveCrypto
 	senderDF   *udpSenderDF
 	maxPayload int
 
@@ -345,15 +351,15 @@ type controlMessage struct {
 
 func (sleeve *SleeveOverlay) MakeForwarder(params ForwarderParams) (OverlayForwarder, error) {
 	name := sleeve.localPeer.NameByte
-	var crypto OverlayCrypto
+	var crypto sleeveCrypto
 	if params.SessionKey != nil {
-		crypto = OverlayCrypto{
+		crypto = sleeveCrypto{
 			Dec:   NewNaClDecryptor(params.SessionKey, params.Outbound),
 			Enc:   NewNaClEncryptor(name, params.SessionKey, params.Outbound, false),
 			EncDF: NewNaClEncryptor(name, params.SessionKey, params.Outbound, true),
 		}
 	} else {
-		crypto = OverlayCrypto{
+		crypto = sleeveCrypto{
 			Dec:   NewNonDecryptor(),
 			Enc:   NewNonEncryptor(name),
 			EncDF: NewNonEncryptor(name),