diff --git a/.rubocop.yml b/.rubocop.yml
index d301b55..9ba0432 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -1,4 +1,6 @@
 ---
+inherit_from: .rubocop_todo.yml
+
 require:
   - rubocop-performance
   - rubocop-rake
@@ -9,7 +11,7 @@ AllCops:
   DisplayCopNames: true
   ExtraDetails: true
   DisplayStyleGuide: true
-  TargetRubyVersion: '2.6'
+  TargetRubyVersion: '2.7'
   Exclude:
   - vendor/**/*
   - .vendor/**/*
diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
new file mode 100644
index 0000000..c421a93
--- /dev/null
+++ b/.rubocop_todo.yml
@@ -0,0 +1,391 @@
+# This configuration was generated by
+# `rubocop --auto-gen-config`
+# on 2024-05-02 18:29:47 UTC using RuboCop version 1.50.2.
+# The point is for the user to remove these configuration records
+# one by one as the offenses are removed from the code base.
+# Note that changes in the inspected code, or installation of new
+# versions of RuboCop, may require this file to be generated again.
+
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: AllowForAlignment.
+Layout/CommentIndentation:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/subcommands/help.rb'
+
+# Offense count: 1
+Lint/DuplicateMethods:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+
+# Offense count: 5
+Lint/MissingSuper:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/parser/encrypted_tokens.rb'
+
+# Offense count: 2
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: AllowedImplicitNamespaces.
+# AllowedImplicitNamespaces: Gem
+Lint/RaiseException:
+  Exclude:
+    - 'lib/hiera/backend/eyaml_backend.rb'
+
+# Offense count: 1
+Lint/RescueException:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+
+# Offense count: 1
+Lint/ShadowingOuterLocalVariable:
+  Exclude:
+    - 'lib/hiera/backend/eyaml_backend.rb'
+
+# Offense count: 7
+Lint/UselessAssignment:
+  Exclude:
+    - 'features/support/env.rb'
+    - 'lib/hiera/backend/eyaml/plugins.rb'
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/unknown_command.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/version.rb'
+    - 'lib/hiera/backend/eyaml/utils.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Lint/UselessMethodDefinition:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/parser/token.rb'
+
+# Offense count: 1
+# Configuration parameters: CheckForMethodsWithNoSideEffects.
+Lint/Void:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/parser/token.rb'
+
+# Offense count: 1
+Naming/AccessorMethodName:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/parser/encrypted_tokens.rb'
+
+# Offense count: 1
+# Configuration parameters: AllowedNames.
+# AllowedNames: module_parent
+Naming/ClassAndModuleCamelCase:
+  Exclude:
+    - 'lib/hiera/backend/eyaml_backend.rb'
+
+# Offense count: 1
+# Configuration parameters: ExpectMatchingDefinition, CheckDefinitionPathHierarchy, CheckDefinitionPathHierarchyRoots, Regex, IgnoreExecutableScripts, AllowedAcronyms.
+# CheckDefinitionPathHierarchyRoots: lib, spec, test, src
+# AllowedAcronyms: CLI, DSL, ACL, API, ASCII, CPU, CSS, DNS, EOF, GUID, HTML, HTTP, HTTPS, ID, IP, JSON, LHS, QPS, RAM, RHS, RPC, SLA, SMTP, SQL, SSH, TCP, TLS, TTL, UDP, UI, UID, UUID, URI, URL, UTF8, VM, XML, XMPP, XSRF, XSS
+Naming/FileName:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/CLI.rb'
+
+# Offense count: 3
+# Configuration parameters: ForbiddenDelimiters.
+# ForbiddenDelimiters: (?i-mx:(^|\s)(EO[A-Z]{1}|END)(\s|$))
+Naming/HeredocDelimiterNaming:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/subcommands/edit.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/help.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/unknown_command.rb'
+
+# Offense count: 1
+# Configuration parameters: AllowedPatterns.
+# SupportedStyles: snake_case, camelCase
+Naming/MethodName:
+  EnforcedStyle: snake_case
+
+# Offense count: 1
+# Configuration parameters: MinNameLength, AllowNamesEndingInNumbers, AllowedNames, ForbiddenNames.
+# AllowedNames: as, at, by, cc, db, id, if, in, io, ip, of, on, os, pp, to
+Naming/MethodParameterName:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/parser/parser.rb'
+
+# Offense count: 1
+# Configuration parameters: EnforcedStyle, CheckMethodNames, CheckSymbols, AllowedIdentifiers, AllowedPatterns.
+# SupportedStyles: snake_case, normalcase, non_integer
+# AllowedIdentifiers: capture3, iso8601, rfc1123_date, rfc822, rfc2822, rfc3339, x86_64
+Naming/VariableNumber:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/utils.rb'
+
+# Offense count: 3
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Performance/Casecmp:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/highlinehelper.rb'
+    - 'lib/hiera/backend/eyaml/utils.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Performance/Detect:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/edithelper.rb'
+
+# Offense count: 5
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Performance/MapCompact:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/edithelper.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/decrypt.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/encrypt.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/help.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/unknown_command.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: MaxKeyValuePairs.
+Performance/RedundantMerge:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/logginghelper.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Performance/StringInclude:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/utils.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Security/IoMethods:
+  Exclude:
+    - 'tools/git_tag_release.rb'
+
+# Offense count: 1
+Security/Open:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/encrypthelper.rb'
+
+# Offense count: 2
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Security/YAMLLoad:
+  Exclude:
+    - 'features/step_definitions/decrypt_steps.rb'
+    - 'lib/hiera/backend/eyaml_backend.rb'
+
+# Offense count: 9
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: EnforcedStyle.
+# SupportedStyles: always, conditionals
+Style/AndOr:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/encryptors/pkcs7.rb'
+    - 'lib/hiera/backend/eyaml/highlinehelper.rb'
+    - 'lib/hiera/backend/eyaml/logginghelper.rb'
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+    - 'lib/hiera/backend/eyaml_backend.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: MinBranchesCount.
+Style/CaseLikeIf:
+  Exclude:
+    - 'lib/hiera/backend/eyaml_backend.rb'
+
+# Offense count: 18
+Style/ClassVars:
+  Exclude:
+    - 'lib/hiera/backend/eyaml.rb'
+    - 'lib/hiera/backend/eyaml/commands.rb'
+    - 'lib/hiera/backend/eyaml/options.rb'
+    - 'lib/hiera/backend/eyaml/parser/encrypted_tokens.rb'
+    - 'lib/hiera/backend/eyaml/plugins.rb'
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/unknown_command.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Style/CollectionCompact:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/parser/parser.rb'
+
+# Offense count: 35
+# Configuration parameters: AllowedConstants.
+Style/Documentation:
+  Enabled: false
+
+# Offense count: 2
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Style/EnvHome:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/edithelper.rb'
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+
+# Offense count: 10
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: MaxUnannotatedPlaceholdersAllowed, AllowedMethods, AllowedPatterns.
+# SupportedStyles: annotated, template, unannotated
+Style/FormatStringToken:
+  EnforcedStyle: unannotated
+
+# Offense count: 37
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: EnforcedStyle.
+# SupportedStyles: always, always_true, never
+Style/FrozenStringLiteralComment:
+  Enabled: false
+
+# Offense count: 2
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Style/GlobalStdStream:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/subcommands/decrypt.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/encrypt.rb'
+
+# Offense count: 6
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Style/IdenticalConditionalBranches:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/decrypt.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/edit.rb'
+
+# Offense count: 3
+# This cop supports safe autocorrection (--autocorrect).
+Style/IfUnlessModifier:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/encryptors/pkcs7.rb'
+    - 'lib/hiera/backend/eyaml/parser/encrypted_tokens.rb'
+
+# Offense count: 2
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: AllowedMethods.
+# AllowedMethods: nonzero?
+Style/IfWithBooleanLiteralBranches:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/highlinehelper.rb'
+    - 'lib/hiera/backend/eyaml_backend.rb'
+
+# Offense count: 1
+Style/MultilineBlockChain:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/parser/parser.rb'
+
+# Offense count: 2
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: EnforcedStyle.
+# SupportedStyles: literals, strict
+Style/MutableConstant:
+  Exclude:
+    - 'lib/hiera/backend/eyaml.rb'
+
+# Offense count: 8
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: EnforcedStyle, AllowedMethods, AllowedPatterns.
+# SupportedStyles: predicate, comparison
+Style/NumericPredicate:
+  Exclude:
+    - 'spec/**/*'
+    - 'lib/hiera/backend/eyaml/logginghelper.rb'
+    - 'lib/hiera/backend/eyaml/parser/parser.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/edit.rb'
+    - 'lib/hiera/backend/eyaml/utils.rb'
+    - 'tools/git_tag_release.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: EnforcedStyle.
+# SupportedStyles: short, verbose
+Style/PreferredHashMethods:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: Methods.
+Style/RedundantArgument:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/edithelper.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: AllowComments.
+Style/RedundantInitialize:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/parser/token.rb'
+
+# Offense count: 6
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Style/RedundantInterpolation:
+  Exclude:
+    - 'features/support/env.rb'
+    - 'lib/hiera/backend/eyaml/encrypthelper.rb'
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/edit.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/recrypt.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: ConvertCodeThatCanStartToReturnNil, AllowedMethods, MaxChainLength.
+# AllowedMethods: present?, blank?, presence, try, try!
+Style/SafeNavigation:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Style/SelectByRegexp:
+  Exclude:
+    - 'hiera-eyaml.gemspec'
+
+# Offense count: 2
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Style/SlicingWithRange:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/edithelper.rb'
+    - 'tools/git_tag_release.rb'
+
+# Offense count: 4
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: RequireEnglish, EnforcedStyle.
+# SupportedStyles: use_perl_names, use_english_names, use_builtin_english_names
+Style/SpecialGlobalVars:
+  Exclude:
+    - 'hiera-eyaml.gemspec'
+    - 'lib/hiera/backend/eyaml/subcommands/edit.rb'
+
+# Offense count: 12
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: Mode.
+Style/StringConcatenation:
+  Exclude:
+    - 'features/support/env.rb'
+    - 'lib/hiera/backend/eyaml/edithelper.rb'
+    - 'lib/hiera/backend/eyaml/parser/encrypted_tokens.rb'
+    - 'lib/hiera/backend/eyaml/subcommand.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/decrypt.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/help.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/unknown_command.rb'
+    - 'lib/hiera/backend/eyaml/utils.rb'
+    - 'tools/git_tag_release.rb'
+
+# Offense count: 9
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: AllowMethodsWithArguments, AllowedMethods, AllowedPatterns, AllowComments.
+# AllowedMethods: define_method
+Style/SymbolProc:
+  Exclude:
+    - 'features/step_definitions/recrypt_steps.rb'
+    - 'lib/hiera/backend/eyaml/parser/parser.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/decrypt.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/edit.rb'
+    - 'lib/hiera/backend/eyaml/subcommands/encrypt.rb'
+    - 'lib/hiera/backend/eyaml/utils.rb'
+    - 'lib/hiera/backend/eyaml_backend.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Style/ZeroLengthPredicate:
+  Exclude:
+    - 'lib/hiera/backend/eyaml/parser/parser.rb'
+
+# Offense count: 8
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: AllowHeredoc, AllowURI, URISchemes, IgnoreCopDirectives, AllowedPatterns.
+# URISchemes: http, https
+Layout/LineLength:
+  Max: 194
diff --git a/Rakefile b/Rakefile
index 7cf2a2b..c3a0c87 100644
--- a/Rakefile
+++ b/Rakefile
@@ -27,7 +27,7 @@ require 'bundler/gem_tasks'
 # https://stackoverflow.com/questions/6473419/using-simplecov-to-display-cucumber-code-coverage
 require 'cucumber/rake/task'
 Cucumber::Rake::Task.new(:features) do |t|
-  t.cucumber_opts = %w(--format progress) # Any valid command line option can go here.
+  t.cucumber_opts = %w[--format progress] # Any valid command line option can go here.
 end
 
 begin
diff --git a/features/step_definitions/environment_overrides.rb b/features/step_definitions/environment_overrides.rb
index 08f72a3..10c51ae 100644
--- a/features/step_definitions/environment_overrides.rb
+++ b/features/step_definitions/environment_overrides.rb
@@ -14,6 +14,7 @@
 Given(/^my PATH contains "(.*?)"$/) do |path_value|
   abspath = expand_path(path_value)
   return if ENV['PATH'].start_with? abspath
+
   paths = [path_value] + ENV['PATH'].split(File::PATH_SEPARATOR)
   ENV['PATH'] = paths.join(File::PATH_SEPARATOR)
   prepend_environment_variable 'PATH', abspath + File::PATH_SEPARATOR
diff --git a/features/step_definitions/parser_steps.rb b/features/step_definitions/parser_steps.rb
index 471e20c..225bafd 100644
--- a/features/step_definitions/parser_steps.rb
+++ b/features/step_definitions/parser_steps.rb
@@ -23,8 +23,8 @@
   # fake ENV state and the real ENV state.
   delete_environment_variable 'EYAML_PUBLIC_KEY'
   delete_environment_variable 'EYAML_PRIVATE_KEY'
-  ENV['EYAML_PUBLIC_KEY']=''
-  ENV['EYAML_PRIVATE_KEY']=''
+  ENV['EYAML_PUBLIC_KEY'] = ''
+  ENV['EYAML_PRIVATE_KEY'] = ''
 end
 
 And(/^I configure the keypair using envvars$/) do
@@ -53,8 +53,8 @@
   # fake ENV state and the real ENV state.
   set_environment_variable 'EYAML_PUBLIC_KEY', pubkey
   set_environment_variable 'EYAML_PRIVATE_KEY', privkey
-  ENV['EYAML_PUBLIC_KEY']=pubkey
-  ENV['EYAML_PRIVATE_KEY']=privkey
+  ENV['EYAML_PUBLIC_KEY'] = pubkey
+  ENV['EYAML_PRIVATE_KEY'] = privkey
 end
 
 When(/^I parse the content$/) do
@@ -62,7 +62,7 @@
 end
 
 Then(/^I should have (\d+) tokens?$/) do |number_of_tokens|
-  expect(@tokens.size).to eq (number_of_tokens.to_i)
+  expect(@tokens.size).to eq(number_of_tokens.to_i)
 end
 
 Then(/^token (\d+) should be a (.*)$/) do |index, class_name|
@@ -98,5 +98,5 @@
 
 Then(/^token (\d+) id should be (\d+)$/) do |index, token_id|
   token = @tokens[index.to_i - 1]
-  expect(token.id).to eq (token_id.to_i)
+  expect(token.id).to eq(token_id.to_i)
 end
diff --git a/features/step_definitions/recrypt_steps.rb b/features/step_definitions/recrypt_steps.rb
index dfcc68e..74dddbc 100644
--- a/features/step_definitions/recrypt_steps.rb
+++ b/features/step_definitions/recrypt_steps.rb
@@ -15,7 +15,7 @@
 end
 
 Then(/the recrypted tokens should match/) do
-  expect(@tokens.size).to eq (@tokens_check.size.to_i)
+  expect(@tokens.size).to eq(@tokens_check.size.to_i)
 end
 
 Then(/the recrypted decrypted content should match/) do
@@ -29,5 +29,5 @@
 Then(/^the tokens at (\d+) should match/) do |index|
   decrypted1 = @tokens[index.to_i]
   decrypted2 = @tokens_check[index.to_i]
-  expect(decrypted1.to_decrypted).to eq (decrypted2.to_decrypted)
+  expect(decrypted1.to_decrypted).to eq(decrypted2.to_decrypted)
 end
diff --git a/features/support/env.rb b/features/support/env.rb
index 5574885..4bcac1b 100644
--- a/features/support/env.rb
+++ b/features/support/env.rb
@@ -28,7 +28,7 @@
   # A number of checks require absolute paths.
   config.allow_absolute_paths = true
   # Setup the test environment.
-  config.before :command do |cmd|
+  config.before :command do |_cmd|
     SetupSandbox.create_files aruba.config.working_directory, test_files
   end
 end
@@ -36,7 +36,7 @@
 Before do
   home_dir = 'clean_home'
   # set to a non-existant home in order so rogue configs don't confuse
-  #set_environment_variable 'HOME', home_dir
+  # set_environment_variable 'HOME', home_dir
   ## But it must be an absolute path for other code
   # e.g. puppet will throw: "Error: Could not initialize global default settings: non-absolute home"
   set_environment_variable 'HOME', expand_path(home_dir)
diff --git a/lib/hiera/backend/eyaml/encryptors/pkcs7.rb b/lib/hiera/backend/eyaml/encryptors/pkcs7.rb
index 9e4f65d..dfaaabb 100644
--- a/lib/hiera/backend/eyaml/encryptors/pkcs7.rb
+++ b/lib/hiera/backend/eyaml/encryptors/pkcs7.rb
@@ -33,11 +33,10 @@ class Pkcs7 < Encryptor
 
           self.tag = 'PKCS7'
 
-
           def self.encrypt(plaintext)
             LoggingHelper.trace 'PKCS7 encrypt'
 
-            public_key_pem = self.load_public_key_pem()
+            public_key_pem = load_public_key_pem
             public_key_x509 = OpenSSL::X509::Certificate.new(public_key_pem)
 
             cipher = OpenSSL::Cipher.new('aes-256-cbc')
@@ -47,10 +46,10 @@ def self.encrypt(plaintext)
           def self.decrypt(ciphertext)
             LoggingHelper.trace 'PKCS7 decrypt'
 
-            private_key_pem = self.load_private_key_pem()
+            private_key_pem = load_private_key_pem
             private_key_rsa = OpenSSL::PKey::RSA.new(private_key_pem)
 
-            public_key_pem = self.load_public_key_pem()
+            public_key_pem = load_public_key_pem
             public_key_x509 = OpenSSL::X509::Certificate.new(public_key_pem)
 
             pkcs7 = OpenSSL::PKCS7.new(ciphertext)
@@ -100,11 +99,9 @@ def self.create_keys
             LoggingHelper.info 'Keys created OK'
           end
 
-          protected
-
           def self.load_ANY_key_pem(optname_key, optname_env_var)
-            opt_key = option (optname_key.to_sym)
-            opt_key_env_var = option (optname_env_var.to_sym)
+            opt_key = option(optname_key.to_sym)
+            opt_key_env_var = option(optname_env_var.to_sym)
 
             if opt_key and opt_key_env_var
               warn "both #{optname_key} and #{optname_env_var} specified, using #{optname_env_var}"
@@ -112,25 +109,26 @@ def self.load_ANY_key_pem(optname_key, optname_env_var)
 
             if opt_key_env_var
               raise StandardError, "env #{opt_key_env_var} is not set" unless ENV[opt_key_env_var]
-              opt_key_pem = ENV[opt_key_env_var]
+
+              opt_key_pem = ENV.fetch(opt_key_env_var, nil)
             elsif opt_key
               raise StandardError, "file #{opt_key} does not exist" unless File.exist? opt_key
+
               opt_key_pem = File.read opt_key
             else
               raise StandardError, "pkcs7_#{optname_key} is not defined" unless opt_key or opt_key_env_var
             end
 
-            return opt_key_pem
+            opt_key_pem
           end
 
           def self.load_public_key_pem
-            return self.load_ANY_key_pem('public_key', 'public_key_env_var')
+            load_ANY_key_pem('public_key', 'public_key_env_var')
           end
 
           def self.load_private_key_pem
-            return self.load_ANY_key_pem('private_key', 'private_key_env_var')
+            load_ANY_key_pem('private_key', 'private_key_env_var')
           end
-
         end
       end
     end
diff --git a/lib/hiera/backend/eyaml/logginghelper.rb b/lib/hiera/backend/eyaml/logginghelper.rb
index ebba05b..c844449 100644
--- a/lib/hiera/backend/eyaml/logginghelper.rb
+++ b/lib/hiera/backend/eyaml/logginghelper.rb
@@ -5,14 +5,13 @@ class Hiera
   module Backend
     module Eyaml
       class LoggingHelper
-
-        def self.structure_message messageinfo
-          message = {:from => "hiera-eyaml-core"}
+        def self.structure_message(messageinfo)
+          message = { from: 'hiera-eyaml-core' }
           case messageinfo.class.to_s
           when 'Hash'
             message.merge!(messageinfo)
           else
-            message.merge!({:msg => messageinfo.to_s})
+            message.merge!({ msg: messageinfo.to_s })
           end
           message[:prefix] = "[#{message[:from]}]"
           message[:spacer] = " #{' ' * message[:from].length} "
@@ -26,54 +25,53 @@ def self.structure_message messageinfo
           formatted_output.join "\n"
         end
 
-        def self.warn messageinfo
-          self.print_message({ :message => self.structure_message( messageinfo ), :hiera_loglevel => :warn, :cli_color => :red })
+        def self.warn(messageinfo)
+          print_message({ message: structure_message(messageinfo), hiera_loglevel: :warn, cli_color: :red })
         end
 
-        def self.info messageinfo
-          self.print_message({ :message => self.structure_message( messageinfo ), :hiera_loglevel => :debug, :cli_color => :white, :threshold => 0 })
+        def self.info(messageinfo)
+          print_message({ message: structure_message(messageinfo), hiera_loglevel: :debug, cli_color: :white, threshold: 0 })
         end
 
-        def self.debug messageinfo
-          self.print_message({ :message => self.structure_message( messageinfo ), :hiera_loglevel => :debug, :cli_color => :green, :threshold => 1 })
+        def self.debug(messageinfo)
+          print_message({ message: structure_message(messageinfo), hiera_loglevel: :debug, cli_color: :green, threshold: 1 })
         end
 
-        def self.trace messageinfo
-          self.print_message({ :message => self.structure_message( messageinfo ), :hiera_loglevel => :debug, :cli_color => :blue, :threshold => 2 })
+        def self.trace(messageinfo)
+          print_message({ message: structure_message(messageinfo), hiera_loglevel: :debug, cli_color: :blue, threshold: 2 })
         end
 
-        def self.print_message( args )
-          message        = args[:message] ||= ""
+        def self.print_message(args)
+          message        = args[:message] ||= ''
           hiera_loglevel = args[:hiera_loglevel] ||= :debug
           cli_color      = args[:cli_color] ||= :blue
           threshold      = args[:threshold]
 
-          if self.hiera?
+          if hiera?
             Hiera.send(hiera_loglevel, message) if threshold.nil? or Eyaml.verbosity_level > threshold
-          else
-            STDERR.puts self.colorize( message, cli_color ) if threshold.nil? or Eyaml.verbosity_level > threshold
+          elsif threshold.nil? or Eyaml.verbosity_level > threshold
+            warn colorize(message, cli_color)
           end
         end
 
-        def self.colorize message, color
+        def self.colorize(message, color)
           suffix = "\e[0m"
           prefix = case color
-          when :red
-            "\e[31m"
-          when :green
-            "\e[32m"
-          when :blue
-            "\e[34m"
-          else #:white
-            "\e[0m"
-          end
+                   when :red
+                     "\e[31m"
+                   when :green
+                     "\e[32m"
+                   when :blue
+                     "\e[34m"
+                   else # :white
+                     "\e[0m"
+                   end
           "#{prefix}#{message}#{suffix}"
         end
 
         def self.hiera?
-          "hiera".eql? Eyaml::Options[:source]
+          'hiera'.eql? Eyaml::Options[:source]
         end
-
       end
     end
   end
diff --git a/lib/hiera/backend/eyaml/subcommand.rb b/lib/hiera/backend/eyaml/subcommand.rb
index bbda6b2..efab19e 100644
--- a/lib/hiera/backend/eyaml/subcommand.rb
+++ b/lib/hiera/backend/eyaml/subcommand.rb
@@ -39,9 +39,9 @@ def self.load_config_file
           config_paths += ['/etc/eyaml/config.yaml']
           # Home directory
           env_home = ENV.fetch('HOME', nil)
-          config_paths += [ "#{env_home}/.eyaml/config.yaml" ] if env_home
+          config_paths += ["#{env_home}/.eyaml/config.yaml"] if env_home
           # Relative to current directory
-          config_paths += [ ".eyaml/config.yaml" ]
+          config_paths += ['.eyaml/config.yaml']
           # Explicit ENV variable.
           env_eyaml_config = ENV.fetch('EYAML_CONFIG', nil)
           config_paths += [env_eyaml_config] if env_eyaml_config