diff --git a/package.json b/package.json
index c6a17aab..b89c2f9e 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
     "protons": "^1.0.1",
     "rsa-pem-to-jwk": "^1.1.3",
     "tweetnacl": "^1.0.0",
+    "ursa-optional": "^0.9.6",
     "webcrypto-shim": "github:dignifiedquire/webcrypto-shim#master"
   },
   "devDependencies": {
diff --git a/src/keys/rsa.js b/src/keys/rsa.js
index 2da2678b..86e669f5 100644
--- a/src/keys/rsa.js
+++ b/src/keys/rsa.js
@@ -1,7 +1,19 @@
 'use strict'
 
 const crypto = require('crypto')
-const keypair = require('keypair')
+let keypair
+try {
+  const ursa = require('ursa-optional') // throws if not compiled
+  keypair = ({bits}) => {
+    const key = ursa.generatePrivateKey(bits)
+    return {
+      private: key.toPrivatePem(),
+      public: key.toPublicPem()
+    }
+  }
+} catch (e) {
+  keypair = require('keypair')
+}
 const setImmediate = require('async/setImmediate')
 const pemToJwk = require('pem-jwk').pem2jwk
 const jwkToPem = require('pem-jwk').jwk2pem