diff --git a/data/account/participationRegistry.go b/data/account/participationRegistry.go
index e1c82a8924..483acde5d9 100644
--- a/data/account/participationRegistry.go
+++ b/data/account/participationRegistry.go
@@ -232,7 +232,7 @@ type ParticipationRegistry interface {
 	// once, an error will occur when the data is flushed when inserting a duplicate key.
 	AppendKeys(id ParticipationID, keys StateProofKeys) error
 
-	// DeleteStateProofKeys removes all stateproof keys preceding a given round (including)
+	// DeleteStateProofKeys removes all stateproof keys up to, and not including, a given round
 	DeleteStateProofKeys(id ParticipationID, round basics.Round) error
 
 	// Delete removes a record from storage.
@@ -347,7 +347,7 @@ const (
 	insertKeysetQuery         = `INSERT INTO Keysets (participationID, account, firstValidRound, lastValidRound, keyDilution, vrf, stateProof) VALUES (?, ?, ?, ?, ?, ?, ?)`
 	insertRollingQuery        = `INSERT INTO Rolling (pk, voting) VALUES (?, ?)`
 	appendStateProofKeysQuery = `INSERT INTO StateProofKeys (pk, round, key) VALUES(?, ?, ?)`
-	deleteStateProofKeysQuery = `DELETE FROM StateProofKeys WHERE pk=? AND round<=?`
+	deleteStateProofKeysQuery = `DELETE FROM StateProofKeys WHERE pk=? AND round<?`
 
 	// SELECT pk FROM Keysets WHERE participationID = ?
 	selectPK      = `SELECT pk FROM Keysets WHERE participationID = ? LIMIT 1`
diff --git a/data/accountManager.go b/data/accountManager.go
index aa5064e093..6ca7d4cfa4 100644
--- a/data/accountManager.go
+++ b/data/accountManager.go
@@ -45,7 +45,8 @@ type AccountManager struct {
 	log      logging.Logger
 }
 
-// DeleteStateProofKey deletes all keys connected to ParticipationID that came before (including) the given round.
+// DeleteStateProofKey deletes keys related to a ParticipationID. The function removes
+// all keys up to, and not including, a given round the given round.
 func (manager *AccountManager) DeleteStateProofKey(id account.ParticipationID, round basics.Round) error {
 	return manager.registry.DeleteStateProofKeys(id, round)
 }
@@ -61,6 +62,19 @@ func MakeAccountManager(log logging.Logger, registry account.ParticipationRegist
 	return manager
 }
 
+// DeleteStateProofKeysForExpiredAccounts removes ephemeral keys for every expired account
+func (manager *AccountManager) DeleteStateProofKeysForExpiredAccounts(currentRound basics.Round) {
+	for _, part := range manager.registry.GetAll() {
+		if currentRound <= part.LastValid {
+			continue
+		}
+		// since DeleteStateProofKeys doesn't remove the last round, we add one to make sure all secrets are being removed
+		if err := manager.DeleteStateProofKey(part.ParticipationID, part.LastValid+1); err != nil {
+			manager.log.Warnf("error while removing state proof keys for participant %v on round %v: %v", part.ParticipationID, part.LastValid+1, err)
+		}
+	}
+}
+
 // Keys returns a list of Participation accounts, and their keys/secrets for requested round.
 func (manager *AccountManager) Keys(rnd basics.Round) (out []account.ParticipationRecordForRound) {
 	for _, part := range manager.registry.GetAll() {
@@ -82,7 +96,7 @@ func (manager *AccountManager) StateProofKeys(rnd basics.Round) (out []account.S
 		if part.StateProof != nil && part.OverlapsInterval(rnd, rnd) {
 			partRndSecrets, err := manager.registry.GetStateProofSecretsForRound(part.ParticipationID, rnd)
 			if err != nil {
-				manager.log.Errorf("error while loading round secrets from participation registry: %v", err)
+				manager.log.Warnf("could not load state proof keys from participation registry: %v", err)
 				continue
 			}
 			out = append(out, partRndSecrets)
diff --git a/data/accountManager_test.go b/data/accountManager_test.go
index 1fcfe56bf7..e570c825ee 100644
--- a/data/accountManager_test.go
+++ b/data/accountManager_test.go
@@ -250,6 +250,63 @@ func TestAccountManagerOverlappingStateProofKeys(t *testing.T) {
 	a.Equal(1, len(res))
 }
 
+func TestAccountManagerRemoveStateProofKeysForExpiredAccounts(t *testing.T) {
+	partitiontest.PartitionTest(t)
+	a := assert.New(t)
+
+	registry, dbName := getRegistryImpl(t, false, true)
+	defer registryCloseTest(t, registry, dbName)
+
+	log := logging.TestingLog(t)
+	log.SetLevel(logging.Error)
+
+	acctManager := MakeAccountManager(log, registry)
+
+	databaseFiles := make([]string, 0)
+	defer func() {
+		for _, fileName := range databaseFiles {
+			os.Remove(fileName)
+			os.Remove(fileName + "-shm")
+			os.Remove(fileName + "-wal")
+			os.Remove(fileName + "-journal")
+		}
+	}()
+
+	store, err := db.MakeAccessor("stateprooftest", false, true)
+	a.NoError(err)
+	root, err := account.GenerateRoot(store)
+	a.NoError(err)
+	part1, err := account.FillDBWithParticipationKeys(store, root.Address(), 0, basics.Round(merklesignature.KeyLifetimeDefault*2), 3)
+	a.NoError(err)
+	store.Close()
+
+	keys1 := part1.StateProofSecrets.GetAllKeys()
+
+	// Add participations to the registry and append StateProof keys as well
+	part1ID, err := acctManager.registry.Insert(part1.Participation)
+	a.NoError(err)
+	err = registry.AppendKeys(part1ID, keys1)
+	a.NoError(err)
+
+	err = acctManager.registry.Flush(10 * time.Second)
+	a.NoError(err)
+
+	for i := 1; i <= 2; i++ {
+		res := acctManager.StateProofKeys(basics.Round(i * merklesignature.KeyLifetimeDefault))
+		a.Equal(1, len(res))
+	}
+
+	acctManager.DeleteStateProofKeysForExpiredAccounts(part1.LastValid + 1)
+	err = acctManager.registry.Flush(10 * time.Second)
+	a.NoError(err)
+
+	for i := 1; i <= 2; i++ {
+		res := acctManager.StateProofKeys(basics.Round(i * merklesignature.KeyLifetimeDefault))
+		a.Equal(0, len(res))
+	}
+
+}
+
 func TestGetStateProofKeysDontLogErrorOnNilStateProof(t *testing.T) {
 	partitiontest.PartitionTest(t)
 	a := assert.New(t)
diff --git a/stateproof/abstractions.go b/stateproof/abstractions.go
index 825b5090ea..951bb76587 100644
--- a/stateproof/abstractions.go
+++ b/stateproof/abstractions.go
@@ -55,6 +55,7 @@ type Network interface {
 type Accounts interface {
 	StateProofKeys(basics.Round) []account.StateProofSecretsForRound
 	DeleteStateProofKey(id account.ParticipationID, round basics.Round) error
+	DeleteStateProofKeysForExpiredAccounts(currentRound basics.Round)
 }
 
 // BlockHeaderFetcher captures the aspects of the Ledger that is used to fetch block headers
diff --git a/stateproof/builder.go b/stateproof/builder.go
index 42cc77f81e..fa955af227 100644
--- a/stateproof/builder.go
+++ b/stateproof/builder.go
@@ -366,8 +366,7 @@ func (spw *Worker) builder(latest basics.Round) {
 			continue
 		}
 
-		spw.deleteOldSigs(&hdr)
-		spw.deleteOldBuilders(&hdr)
+		spw.deleteStaleStateProofBuildData(&hdr)
 
 		// Broadcast signatures based on the previous block(s) that
 		// were agreed upon.  This ensures that, if we send a signature
@@ -450,31 +449,60 @@ func (spw *Worker) broadcastSigs(brnd basics.Round, proto config.ConsensusParams
 	}
 }
 
-func (spw *Worker) deleteOldSigs(currentHdr *bookkeeping.BlockHeader) {
-	oldestRoundToRemove := GetOldestExpectedStateProof(currentHdr)
+func (spw *Worker) deleteStaleStateProofBuildData(currentHdr *bookkeeping.BlockHeader) {
+	proto := config.Consensus[currentHdr.CurrentProtocol]
+	stateProofNextRound := currentHdr.StateProofTracking[protocol.StateProofBasic].StateProofNextRound
+	if proto.StateProofInterval == 0 || stateProofNextRound == 0 {
+		return
+	}
+
+	if spw.LastCleanupRound == stateProofNextRound {
+		return
+	}
+
+	spw.deleteStaleSigs(stateProofNextRound)
+	spw.deleteStaleKeys(stateProofNextRound)
+	spw.deleteStaleBuilders(stateProofNextRound)
+	spw.LastCleanupRound = stateProofNextRound
+}
 
+func (spw *Worker) deleteStaleSigs(retainRound basics.Round) {
 	err := spw.db.Atomic(func(ctx context.Context, tx *sql.Tx) error {
-		return deletePendingSigsBeforeRound(tx, oldestRoundToRemove)
+		return deletePendingSigsBeforeRound(tx, retainRound)
 	})
 	if err != nil {
-		spw.log.Warnf("deletePendingSigsBeforeRound(%d): %v", oldestRoundToRemove, err)
+		spw.log.Warnf("deleteStaleSigs(%d): %v", retainRound, err)
 	}
 }
 
-func (spw *Worker) deleteOldBuilders(currentHdr *bookkeeping.BlockHeader) {
-	oldestRoundToRemove := GetOldestExpectedStateProof(currentHdr)
+func (spw *Worker) deleteStaleKeys(retainRound basics.Round) {
+	keys := spw.accts.StateProofKeys(retainRound)
+	for _, key := range keys {
+		firstRoundAtKeyLifeTime, err := key.StateProofSecrets.FirstRoundInKeyLifetime()
+		if err != nil {
+			spw.log.Errorf("deleteStaleKeys: could not calculate keylifetime for account %v on round %s:  %v", key.ParticipationID, firstRoundAtKeyLifeTime, err)
+			continue
+		}
+		err = spw.accts.DeleteStateProofKey(key.ParticipationID, basics.Round(firstRoundAtKeyLifeTime))
+		if err != nil {
+			spw.log.Warnf("deleteStaleKeys: could not remove key for account %v on round %s: %v", key.ParticipationID, firstRoundAtKeyLifeTime, err)
+		}
+	}
+	spw.accts.DeleteStateProofKeysForExpiredAccounts(retainRound)
+}
 
+func (spw *Worker) deleteStaleBuilders(retainRound basics.Round) {
 	spw.mu.Lock()
 	defer spw.mu.Unlock()
 
 	for rnd := range spw.builders {
-		if rnd < oldestRoundToRemove {
+		if rnd < retainRound {
 			delete(spw.builders, rnd)
 		}
 	}
 
 	err := spw.db.Atomic(func(ctx context.Context, tx *sql.Tx) error {
-		return deleteBuilders(tx, oldestRoundToRemove)
+		return deleteBuilders(tx, retainRound)
 	})
 	if err != nil {
 		spw.log.Warnf("deleteOldBuilders: failed to delete builders from database: %v", err)
diff --git a/stateproof/signer.go b/stateproof/signer.go
index 02749890a3..ce0e88c94e 100644
--- a/stateproof/signer.go
+++ b/stateproof/signer.go
@@ -21,7 +21,6 @@ import (
 
 	"github.com/algorand/go-algorand/config"
 	"github.com/algorand/go-algorand/crypto/merklesignature"
-	"github.com/algorand/go-algorand/data/account"
 	"github.com/algorand/go-algorand/data/basics"
 	"github.com/algorand/go-algorand/data/bookkeeping"
 	"github.com/algorand/go-algorand/protocol"
@@ -117,8 +116,6 @@ func (spw *Worker) signStateProof(hdr bookkeeping.BlockHeader) {
 	}
 
 	sigs := make([]sigFromAddr, 0, len(keys))
-	ids := make([]account.ParticipationID, 0, len(keys))
-	usedSigners := make([]*merklesignature.Signer, 0, len(keys))
 
 	stateproofMessage, err := GenerateStateProofMessage(spw.ledger, uint64(votersHdr.Round), hdr)
 	if err != nil {
@@ -155,30 +152,15 @@ func (spw *Worker) signStateProof(hdr bookkeeping.BlockHeader) {
 			Round:         hdr.Round,
 			Sig:           sig,
 		})
-		ids = append(ids, key.ParticipationID)
-		usedSigners = append(usedSigners, key.StateProofSecrets)
 	}
 
 	// any error in handle sig indicates the signature wasn't stored in disk, thus we cannot delete the key.
-	for i, sfa := range sigs {
+	for _, sfa := range sigs {
 		if _, err := spw.handleSig(sfa, nil); err != nil {
 			spw.log.Warnf("spw.signBlock(%d): handleSig: %v", hdr.Round, err)
 			continue
 		}
 
 		spw.log.Infof("spw.signBlock(%d): sp message was signed with address %v", hdr.Round, sfa.SignerAddress)
-		firstRoundInKeyLifetime, err := usedSigners[i].FirstRoundInKeyLifetime() // Calculate first round of the key in order to delete all previous keys (and keep the current one for now)
-		if err != nil {
-			spw.log.Warnf("spw.signBlock(%d): Signer.FirstRoundInKeyLifetime: %v", hdr.Round, err)
-			continue
-		}
-		if firstRoundInKeyLifetime == 0 {
-			continue // No previous keys to delete (also underflows when subtracting 1)
-		}
-
-		// Safe to delete key for sfa.Round because the signature is now stored in the disk.
-		if err := spw.accts.DeleteStateProofKey(ids[i], basics.Round(firstRoundInKeyLifetime-1)); err != nil { // Subtract 1 to delete all keys up to this one
-			spw.log.Warnf("spw.signBlock(%d): DeleteStateProofKey: %v", hdr.Round, err)
-		}
 	}
 }
diff --git a/stateproof/stateproofMessageGenerator_test.go b/stateproof/stateproofMessageGenerator_test.go
index 1b909d775f..bb68b89816 100644
--- a/stateproof/stateproofMessageGenerator_test.go
+++ b/stateproof/stateproofMessageGenerator_test.go
@@ -53,6 +53,10 @@ func (s *workerForStateProofMessageTests) DeleteStateProofKey(id account.Partici
 	return s.w.DeleteStateProofKey(id, round)
 }
 
+func (s *workerForStateProofMessageTests) DeleteStateProofKeysForExpiredAccounts(currentRound basics.Round) {
+	s.w.DeleteStateProofKeysForExpiredAccounts(currentRound)
+}
+
 func (s *workerForStateProofMessageTests) Latest() basics.Round {
 	return s.w.Latest()
 }
@@ -149,18 +153,18 @@ func (s *workerForStateProofMessageTests) addBlockWithStateProofHeaders(ccNextRo
 
 func newWorkerForStateProofMessageStubs(keys []account.Participation, totalWeight int) *workerForStateProofMessageTests {
 	s := &testWorkerStubs{
-		t:                     nil,
-		mu:                    deadlock.Mutex{},
-		latest:                0,
-		waiters:               make(map[basics.Round]chan struct{}),
-		waitersCount:          make(map[basics.Round]int),
-		blocks:                make(map[basics.Round]bookkeeping.BlockHeader),
-		keys:                  keys,
-		keysForVoters:         keys,
-		sigmsg:                make(chan []byte, 1024),
-		txmsg:                 make(chan transactions.SignedTxn, 1024),
-		totalWeight:           totalWeight,
-		deletedStateProofKeys: map[account.ParticipationID]basics.Round{},
+		t:                         nil,
+		mu:                        deadlock.Mutex{},
+		latest:                    0,
+		waiters:                   make(map[basics.Round]chan struct{}),
+		waitersCount:              make(map[basics.Round]int),
+		blocks:                    make(map[basics.Round]bookkeeping.BlockHeader),
+		keys:                      keys,
+		keysForVoters:             keys,
+		sigmsg:                    make(chan []byte, 1024),
+		txmsg:                     make(chan transactions.SignedTxn, 1024),
+		totalWeight:               totalWeight,
+		deletedKeysBeforeRoundMap: map[account.ParticipationID]basics.Round{},
 	}
 	sm := workerForStateProofMessageTests{w: s}
 	return &sm
diff --git a/stateproof/worker.go b/stateproof/worker.go
index 7b2cd04e2d..6f61ada46f 100644
--- a/stateproof/worker.go
+++ b/stateproof/worker.go
@@ -65,8 +65,9 @@ type Worker struct {
 	shutdown context.CancelFunc
 	wg       sync.WaitGroup
 
-	signed   basics.Round
-	signedCh chan struct{}
+	signed           basics.Round
+	signedCh         chan struct{}
+	LastCleanupRound basics.Round
 }
 
 // NewWorker constructs a new Worker, as used by the node.
diff --git a/stateproof/worker_test.go b/stateproof/worker_test.go
index c412faddaf..f9465d4e40 100644
--- a/stateproof/worker_test.go
+++ b/stateproof/worker_test.go
@@ -50,37 +50,44 @@ import (
 )
 
 type testWorkerStubs struct {
-	t                     testing.TB
-	mu                    deadlock.Mutex
-	latest                basics.Round
-	waiters               map[basics.Round]chan struct{}
-	waitersCount          map[basics.Round]int
-	blocks                map[basics.Round]bookkeeping.BlockHeader
-	keys                  []account.Participation
-	keysForVoters         []account.Participation
-	sigmsg                chan []byte
-	txmsg                 chan transactions.SignedTxn
-	totalWeight           int
-	deletedStateProofKeys map[account.ParticipationID]basics.Round
+	t                         testing.TB
+	mu                        deadlock.Mutex
+	latest                    basics.Round
+	waiters                   map[basics.Round]chan struct{}
+	waitersCount              map[basics.Round]int
+	blocks                    map[basics.Round]bookkeeping.BlockHeader
+	keys                      []account.Participation
+	keysForVoters             []account.Participation
+	sigmsg                    chan []byte
+	txmsg                     chan transactions.SignedTxn
+	totalWeight               int
+	deletedKeysBeforeRoundMap map[account.ParticipationID]basics.Round
+	version                   protocol.ConsensusVersion
 }
 
 func newWorkerStubs(t testing.TB, keys []account.Participation, totalWeight int) *testWorkerStubs {
+	return newWorkerStubsWithVersion(t, keys, protocol.ConsensusCurrentVersion, totalWeight)
+}
+
+func newWorkerStubsWithVersion(t testing.TB, keys []account.Participation, version protocol.ConsensusVersion, totalWeight int) *testWorkerStubs {
+	proto := config.Consensus[version]
 	s := &testWorkerStubs{
-		t:                     nil,
-		mu:                    deadlock.Mutex{},
-		latest:                0,
-		waiters:               make(map[basics.Round]chan struct{}),
-		waitersCount:          make(map[basics.Round]int),
-		blocks:                make(map[basics.Round]bookkeeping.BlockHeader),
-		keys:                  keys,
-		keysForVoters:         keys,
-		sigmsg:                make(chan []byte, 1024*1024),
-		txmsg:                 make(chan transactions.SignedTxn, 1024),
-		totalWeight:           totalWeight,
-		deletedStateProofKeys: map[account.ParticipationID]basics.Round{},
+		t:                         nil,
+		mu:                        deadlock.Mutex{},
+		latest:                    0,
+		waiters:                   make(map[basics.Round]chan struct{}),
+		waitersCount:              make(map[basics.Round]int),
+		blocks:                    make(map[basics.Round]bookkeeping.BlockHeader),
+		keys:                      keys,
+		keysForVoters:             keys,
+		sigmsg:                    make(chan []byte, 1024*1024),
+		txmsg:                     make(chan transactions.SignedTxn, 1024),
+		totalWeight:               totalWeight,
+		deletedKeysBeforeRoundMap: map[account.ParticipationID]basics.Round{},
+		version:                   version,
 	}
 	s.latest--
-	s.addBlock(2 * basics.Round(config.Consensus[protocol.ConsensusCurrentVersion].StateProofInterval))
+	s.addBlock(2 * basics.Round(proto.StateProofInterval))
 	return s
 }
 
@@ -89,7 +96,7 @@ func (s *testWorkerStubs) addBlock(spNextRound basics.Round) {
 
 	hdr := bookkeeping.BlockHeader{}
 	hdr.Round = s.latest
-	hdr.CurrentProtocol = protocol.ConsensusCurrentVersion
+	hdr.CurrentProtocol = s.version
 
 	var stateProofBasic = bookkeeping.StateProofTrackingData{
 		StateProofVotersCommitment:  make([]byte, stateproof.HashSize),
@@ -114,8 +121,9 @@ func (s *testWorkerStubs) addBlock(spNextRound basics.Round) {
 		close(s.waiters[s.latest])
 	}
 }
-
 func (s *testWorkerStubs) StateProofKeys(rnd basics.Round) (out []account.StateProofSecretsForRound) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
 	for _, part := range s.keys {
 		partRecord := account.ParticipationRecord{
 			ParticipationID:   part.ID(),
@@ -132,6 +140,18 @@ func (s *testWorkerStubs) StateProofKeys(rnd basics.Round) (out []account.StateP
 			Voting:            part.Voting,
 		}
 		signerInRound := part.StateProofSecrets.GetSigner(uint64(rnd))
+		if signerInRound == nil {
+			continue
+		}
+		KeyInLifeTime, _ := signerInRound.FirstRoundInKeyLifetime()
+
+		// simulate that the key was removed
+		if basics.Round(KeyInLifeTime) < s.deletedKeysBeforeRoundMap[part.ID()] {
+			continue
+		}
+		if part.LastValid < rnd {
+			continue
+		}
 		partRecordForRound := account.StateProofSecretsForRound{
 			ParticipationRecord: partRecord,
 			StateProofSecrets:   signerInRound,
@@ -141,16 +161,27 @@ func (s *testWorkerStubs) StateProofKeys(rnd basics.Round) (out []account.StateP
 	return
 }
 
+func (s *testWorkerStubs) DeleteStateProofKeysForExpiredAccounts(currentRound basics.Round) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for _, part := range s.keys {
+		if currentRound <= part.LastValid {
+			continue
+		}
+		s.deletedKeysBeforeRoundMap[part.ID()] = currentRound
+	}
+}
+
 func (s *testWorkerStubs) DeleteStateProofKey(id account.ParticipationID, round basics.Round) error {
 	s.mu.Lock()
-	s.deletedStateProofKeys[id] = round
+	s.deletedKeysBeforeRoundMap[id] = round
 	s.mu.Unlock()
 
 	return nil
 }
 func (s *testWorkerStubs) GetNumDeletedKeys() int {
 	s.mu.Lock()
-	numDeltedKeys := len(s.deletedStateProofKeys)
+	numDeltedKeys := len(s.deletedKeysBeforeRoundMap)
 	s.mu.Unlock()
 
 	return numDeltedKeys
@@ -241,7 +272,7 @@ func (s *testWorkerStubs) BroadcastInternalSignedTxGroup(tx []transactions.Signe
 func (s *testWorkerStubs) RegisterHandlers([]network.TaggedMessageHandler) {
 }
 
-func (s *testWorkerStubs) advanceLatest(delta uint64) {
+func (s *testWorkerStubs) advanceRoundsWithoutStateProof(delta uint64) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
@@ -250,6 +281,23 @@ func (s *testWorkerStubs) advanceLatest(delta uint64) {
 	}
 }
 
+// used to simulate to workers that rounds have advanced, and stateproofs were created.
+func (s *testWorkerStubs) advanceRoundsAndStateProofs(delta uint64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for r := uint64(0); r < delta; r++ {
+		interval := basics.Round(config.Consensus[s.blocks[s.latest].CurrentProtocol].StateProofInterval)
+		blk := s.blocks[s.latest]
+		stateProofNextRound := s.blocks[s.latest].StateProofTracking[protocol.StateProofBasic].StateProofNextRound
+		if blk.Round%interval == 0 && stateProofNextRound-interval < blk.Round {
+			stateProofNextRound += interval
+		}
+
+		s.addBlock(stateProofNextRound)
+	}
+}
+
 func (s *testWorkerStubs) waitOnSigWithTimeout(timeout time.Duration) ([]byte, error) {
 	select {
 	case sig := <-s.sigmsg:
@@ -277,15 +325,19 @@ func newTestWorker(t testing.TB, s *testWorkerStubs) *Worker {
 	return newTestWorkerDB(t, s, dbs.Wdb)
 }
 
+func newPartKey(t testing.TB, parent basics.Address) account.PersistedParticipation {
+	version := config.Consensus[protocol.ConsensusCurrentVersion]
+	return newPartKeyWithVersion(t, version, parent)
+}
+
 // You must call defer part.Close() after calling this function,
 // since it creates a DB accessor but the caller must close it (required for mss)
-func newPartKey(t testing.TB, parent basics.Address) account.PersistedParticipation {
+func newPartKeyWithVersion(t testing.TB, protoParam config.ConsensusParams, parent basics.Address) account.PersistedParticipation {
 	fn := fmt.Sprintf("%s.%d", strings.ReplaceAll(t.Name(), "/", "."), crypto.RandUint64())
 	partDB, err := db.MakeAccessor(fn, false, true)
 	require.NoError(t, err)
 
-	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	part, err := account.FillDBWithParticipationKeys(partDB, parent, 0, basics.Round(15*proto.StateProofInterval), proto.DefaultKeyDilution)
+	part, err := account.FillDBWithParticipationKeys(partDB, parent, 0, basics.Round(15*protoParam.StateProofInterval), protoParam.DefaultKeyDilution)
 	require.NoError(t, err)
 
 	return part
@@ -322,12 +374,12 @@ func TestWorkerAllSigs(t *testing.T) {
 	defer w.Shutdown()
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest(proto.StateProofInterval + proto.StateProofInterval/2)
+	s.advanceRoundsWithoutStateProof(proto.StateProofInterval + proto.StateProofInterval/2)
 
 	// Go through several iterations, making sure that we get
 	// the signatures and certs broadcast at each round.
 	for iter := 0; iter < 5; iter++ {
-		s.advanceLatest(proto.StateProofInterval)
+		s.advanceRoundsWithoutStateProof(proto.StateProofInterval)
 
 		for i := 0; i < len(keys); i++ {
 			// Expect all signatures to be broadcast.
@@ -391,8 +443,8 @@ func TestWorkerPartialSigs(t *testing.T) {
 	defer w.Shutdown()
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest(proto.StateProofInterval + proto.StateProofInterval/2)
-	s.advanceLatest(proto.StateProofInterval)
+	s.advanceRoundsWithoutStateProof(proto.StateProofInterval + proto.StateProofInterval/2)
+	s.advanceRoundsWithoutStateProof(proto.StateProofInterval)
 
 	for i := 0; i < len(keys); i++ {
 		// Expect all signatures to be broadcast.
@@ -408,7 +460,7 @@ func TestWorkerPartialSigs(t *testing.T) {
 	}
 
 	// Expect a state proof to be formed in the next StateProofInterval/2.
-	s.advanceLatest(proto.StateProofInterval / 2)
+	s.advanceRoundsWithoutStateProof(proto.StateProofInterval / 2)
 
 	tx, err := s.waitOnTxnWithTimeout(time.Second * 5)
 	require.NoError(t, err)
@@ -456,7 +508,7 @@ func TestWorkerInsufficientSigs(t *testing.T) {
 	defer w.Shutdown()
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest(3 * proto.StateProofInterval)
+	s.advanceRoundsWithoutStateProof(3 * proto.StateProofInterval)
 
 	for i := 0; i < len(keys); i++ {
 		// Expect all signatures to be broadcast.
@@ -488,7 +540,7 @@ func TestWorkerRestart(t *testing.T) {
 	s := newWorkerStubs(t, keys, 10)
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest(3*proto.StateProofInterval - 1)
+	s.advanceRoundsWithoutStateProof(3*proto.StateProofInterval - 1)
 
 	dbRand := crypto.RandUint64()
 
@@ -534,7 +586,7 @@ func TestWorkerHandleSig(t *testing.T) {
 	defer w.Shutdown()
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest(3 * proto.StateProofInterval)
+	s.advanceRoundsWithoutStateProof(3 * proto.StateProofInterval)
 
 	for i := 0; i < len(keys); i++ {
 		// Expect all signatures to be broadcast.
@@ -551,41 +603,53 @@ func TestWorkerHandleSig(t *testing.T) {
 	}
 }
 
-func TestSignerDeletesUnneededStateProofKeys(t *testing.T) {
-	partitiontest.PartitionTest(t)
-
+func createWorkerAndParticipants(t *testing.T, version protocol.ConsensusVersion, proto config.ConsensusParams) ([]account.Participation, *testWorkerStubs, *Worker) {
 	var keys []account.Participation
-	nParticipants := 2
-	for i := 0; i < nParticipants; i++ {
+	for i := 0; i < 2; i++ {
 		var parent basics.Address
 		crypto.RandBytes(parent[:])
-		p := newPartKey(t, parent)
+		p := newPartKeyWithVersion(t, proto, parent)
 		defer p.Close()
 		keys = append(keys, p.Participation)
 	}
 
-	s := newWorkerStubs(t, keys, 10)
-	w := newTestWorker(t, s)
+	s := newWorkerStubsWithVersion(t, keys, version, 10)
+	dbs, _ := dbOpenTest(t, true)
+
+	logger := logging.NewLogger()
+	logger.SetOutput(io.Discard)
+
+	w := NewWorker(dbs.Wdb, logger, s, s, s, s)
 	w.Start()
-	defer w.Shutdown()
+	return keys, s, w
+}
 
-	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest(3 * proto.StateProofInterval)
-	// Expect all signatures to be broadcast.
+// threshold == 0 meaning nothing was deleted.
+func requireDeletedKeysToBeDeletedBefore(t *testing.T, s *testWorkerStubs, threshold basics.Round) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
 
-	require.Zero(t, s.GetNumDeletedKeys())
-	w.signStateProof(s.blocks[basics.Round(proto.StateProofInterval)])
-	require.Equal(t, s.GetNumDeletedKeys(), nParticipants)
+	for _, prt := range s.keys {
+		if threshold == 0 {
+			require.Equal(t, threshold, s.deletedKeysBeforeRoundMap[prt.ID()])
+			continue
+		}
+		// minus one because we delete keys up to the round stated in the map but not including!
+		require.Greater(t, threshold, s.deletedKeysBeforeRoundMap[prt.ID()]-1)
+	}
 }
 
-func TestSignerDoesntDeleteKeysWhenDBDoesntStoreSigs(t *testing.T) {
+func TestAllKeysRemovedAfterExpiration(t *testing.T) {
 	partitiontest.PartitionTest(t)
 
+	proto := config.Consensus[protocol.ConsensusCurrentVersion]
+	firstExpectedStateproof := basics.Round(proto.StateProofInterval * 2)
+
 	var keys []account.Participation
 	for i := 0; i < 2; i++ {
 		var parent basics.Address
 		crypto.RandBytes(parent[:])
-		p := newPartKey(t, parent)
+		p := newPartKeyWithVersion(t, proto, parent)
 		defer p.Close()
 		keys = append(keys, p.Participation)
 	}
@@ -597,22 +661,157 @@ func TestSignerDoesntDeleteKeysWhenDBDoesntStoreSigs(t *testing.T) {
 	logger.SetOutput(io.Discard)
 
 	w := NewWorker(dbs.Wdb, logger, s, s, s, s)
-
 	w.Start()
 	defer w.Shutdown()
+
+	advanceRoundsAndStateProofsSlowly(t, s, uint64(firstExpectedStateproof)+(12*proto.StateProofInterval))
+	s.mu.Lock()
+	for _, prt := range s.keys {
+		require.Equal(t, uint64(prt.LastValid)-proto.StateProofInterval, uint64(s.deletedKeysBeforeRoundMap[prt.ID()]))
+	}
+	s.mu.Unlock()
+
+	advanceRoundsAndStateProofsSlowly(t, s, proto.StateProofInterval)
+
+	s.mu.Lock()
+	for _, prt := range s.keys {
+		require.Equal(t, prt.LastValid, s.deletedKeysBeforeRoundMap[prt.ID()])
+	}
+	s.mu.Unlock()
+
+	advanceRoundsAndStateProofsSlowly(t, s, proto.StateProofInterval)
+
+	s.mu.Lock()
+	for _, prt := range s.keys {
+		require.Less(t, prt.LastValid, s.deletedKeysBeforeRoundMap[prt.ID()])
+	}
+	s.mu.Unlock()
+}
+
+func TestKeysRemoveOnlyAfterStateProofAccepted(t *testing.T) {
+	partitiontest.PartitionTest(t)
+
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest(3 * proto.StateProofInterval)
-	// Expect all signatures to be broadcast.
+	const expectedNumberOfStateProofs = uint64(3)
+	firstExpectedStateproof := basics.Round(proto.StateProofInterval * 2)
 
-	require.NoError(t, w.db.Atomic(
-		func(ctx context.Context, tx *sql.Tx) error {
-			_, err := tx.Exec("DROP TABLE sigs")
-			return err
-		}),
-	)
+	keys, s, w := createWorkerAndParticipants(t, protocol.ConsensusCurrentVersion, proto)
+	defer w.Shutdown()
+
+	s.advanceRoundsWithoutStateProof(uint64(firstExpectedStateproof) + expectedNumberOfStateProofs*proto.StateProofInterval)
+	err := waitForBuilderAndSignerToWaitOnRound(s)
+	require.NoError(t, err)
 
-	w.signStateProof(s.blocks[3*basics.Round(proto.StateProofInterval)])
-	require.Zero(t, s.GetNumDeletedKeys())
+	// since no state proof was confirmed (i.e the next state proof round == firstExpectedStateproof), we expect a node
+	// to keep its keys to sign the state proof firstExpectedStateproof. every participant should have keys for that round
+	checkedKeys := s.StateProofKeys(firstExpectedStateproof)
+	require.Equal(t, len(keys), len(checkedKeys))
+	requireDeletedKeysToBeDeletedBefore(t, s, firstExpectedStateproof) // i should at this point have the keys to sign on round 512.... how come they were deleted?
+
+	// confirm stateproof for firstExpectedStateproof
+	advanceRoundsAndStateProofsSlowly(t, s, proto.StateProofInterval)
+
+	// the first state proof was confirmed keys for that state proof can be removed
+	// So we should have the not deleted keys for proto.StateProofInterval + firstExpectedStateproof
+	requireDeletedKeysToBeDeletedBefore(t, s, firstExpectedStateproof+basics.Round(proto.StateProofInterval))
+	checkedKeys = s.StateProofKeys(firstExpectedStateproof)
+	require.Equal(t, 0, len(checkedKeys))
+	checkedKeys = s.StateProofKeys(firstExpectedStateproof + basics.Round(proto.StateProofInterval))
+	require.Equal(t, len(keys), len(checkedKeys))
+}
+
+func TestKeysRemoveOnlyAfterStateProofAcceptedSmallIntervals(t *testing.T) {
+	partitiontest.PartitionTest(t)
+
+	const stateProofIntervalForTest = 64
+	const smallIntervalVersionName = "TestKeysRemoveOnlyAfterStateProofAcceptedSmallIntervals"
+	proto := config.Consensus[protocol.ConsensusCurrentVersion]
+	proto.StateProofInterval = stateProofIntervalForTest
+	config.Consensus[smallIntervalVersionName] = proto
+	defer func() {
+		delete(config.Consensus, smallIntervalVersionName)
+	}()
+
+	partitiontest.PartitionTest(t)
+
+	const expectedNumberOfStateProofs = uint64(3)
+	firstExpectedStateproof := basics.Round(proto.StateProofInterval * 2)
+
+	keys, s, w := createWorkerAndParticipants(t, smallIntervalVersionName, proto)
+	defer w.Shutdown()
+
+	s.advanceRoundsWithoutStateProof(uint64(firstExpectedStateproof) + expectedNumberOfStateProofs*proto.StateProofInterval)
+	err := waitForBuilderAndSignerToWaitOnRound(s)
+	require.NoError(t, err)
+
+	// since no state proof was confirmed (i.e the next state proof round == firstExpectedStateproof), we expect a node
+	// to keep its keys to sign the state proof firstExpectedStateproof. every participant should have keys for that round
+	requireDeletedKeysToBeDeletedBefore(t, s, 0)
+	checkedKeys := s.StateProofKeys(firstExpectedStateproof)
+	require.Equal(t, len(keys), len(checkedKeys))
+
+	// confirm stateproof for firstExpectedStateproof
+	advanceRoundsAndStateProofsSlowly(t, s, proto.StateProofInterval)
+
+	// the first state proof was confirmed. However, since keylifetime is greater than the state proof interval
+	// the key for firstExpectedStateproof should be kept (since it is being reused on 3 * proto.StateProofInterval)
+	requireDeletedKeysToBeDeletedBefore(t, s, 0)
+
+	checkedKeys = s.StateProofKeys(firstExpectedStateproof)
+	require.Equal(t, len(keys), len(checkedKeys))
+	checkedKeys = s.StateProofKeys(firstExpectedStateproof + basics.Round(proto.StateProofInterval))
+	require.Equal(t, len(keys), len(checkedKeys))
+}
+
+func TestKeysRemoveOnlyAfterStateProofAcceptedLargeIntervals(t *testing.T) {
+	partitiontest.PartitionTest(t)
+
+	const stateProofIntervalForTest = 260
+	const smallIntervalVersionName = "TestKeysRemoveOnlyAfterStateProofAcceptedLargeIntervals"
+	proto := config.Consensus[protocol.ConsensusCurrentVersion]
+	proto.StateProofInterval = stateProofIntervalForTest
+	config.Consensus[smallIntervalVersionName] = proto
+	defer func() {
+		delete(config.Consensus, smallIntervalVersionName)
+	}()
+
+	const expectedNumberOfStateProofs = uint64(3)
+	firstExpectedStateproof := basics.Round(proto.StateProofInterval * 2)
+
+	keys, s, w := createWorkerAndParticipants(t, protocol.ConsensusCurrentVersion, proto)
+	defer w.Shutdown()
+
+	s.advanceRoundsWithoutStateProof(uint64(firstExpectedStateproof) + expectedNumberOfStateProofs*proto.StateProofInterval)
+	err := waitForBuilderAndSignerToWaitOnRound(s)
+	require.NoError(t, err)
+
+	// since no state proof was confirmed (i.e the next state proof round == firstExpectedStateproof), we expect a node
+	// to keep its keys to sign the state proof firstExpectedStateproof. every participant should have keys for that round
+	requireDeletedKeysToBeDeletedBefore(t, s, firstExpectedStateproof)
+	checkedKeys := s.StateProofKeys(firstExpectedStateproof)
+	require.Equal(t, len(keys), len(checkedKeys))
+
+	// confirm stateproof for firstExpectedStateproof
+	advanceRoundsAndStateProofsSlowly(t, s, proto.StateProofInterval)
+
+	// the first state proof was confirmed keys for that state proof can be removed
+	requireDeletedKeysToBeDeletedBefore(t, s, basics.Round(proto.StateProofInterval)+firstExpectedStateproof)
+
+	checkedKeys = s.StateProofKeys(firstExpectedStateproof)
+	require.Equal(t, 0, len(checkedKeys))
+	checkedKeys = s.StateProofKeys(firstExpectedStateproof + basics.Round(proto.StateProofInterval))
+	require.Equal(t, len(keys), len(checkedKeys))
+}
+
+func advanceRoundsAndStateProofsSlowly(t *testing.T, s *testWorkerStubs, numberOfRounds uint64) {
+	// since adding blocks to our mock ledger happens very fast, the worker might
+	// not iterate over the latest block. Hence, we add some blocks -> wait -> add one more -> wait
+	s.advanceRoundsAndStateProofs(numberOfRounds - 1)
+	err := waitForBuilderAndSignerToWaitOnRound(s)
+	require.NoError(t, err)
+	s.advanceRoundsAndStateProofs(1)
+	err = waitForBuilderAndSignerToWaitOnRound(s)
+	require.NoError(t, err)
 }
 
 func TestWorkerRemoveBuildersAndSignatures(t *testing.T) {
@@ -635,10 +834,10 @@ func TestWorkerRemoveBuildersAndSignatures(t *testing.T) {
 	defer w.Shutdown()
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest(proto.StateProofInterval + proto.StateProofInterval/2)
+	s.advanceRoundsWithoutStateProof(proto.StateProofInterval + proto.StateProofInterval/2)
 
 	for iter := 0; iter < expectedStateProofs; iter++ {
-		s.advanceLatest(proto.StateProofInterval)
+		s.advanceRoundsWithoutStateProof(proto.StateProofInterval)
 		tx := <-s.txmsg
 		a.Equal(tx.Txn.Type, protocol.StateProofTx)
 	}
@@ -678,7 +877,7 @@ func TestWorkerRemoveBuildersAndSignatures(t *testing.T) {
 	a.Equal(3, len(roundSigs))
 }
 
-func TestWorkerBuildersRecoveryLimit(t *testing.T) {
+func TestWorkerBuildersRecoveryIsNotLimited(t *testing.T) {
 	partitiontest.PartitionTest(t)
 	a := require.New(t)
 
@@ -697,10 +896,10 @@ func TestWorkerBuildersRecoveryLimit(t *testing.T) {
 	w.Start()
 	defer w.Shutdown()
 
-	s.advanceLatest(proto.StateProofInterval + proto.StateProofInterval/2)
+	s.advanceRoundsWithoutStateProof(proto.StateProofInterval + proto.StateProofInterval/2)
 
 	for iter := uint64(0); iter < proto.StateProofMaxRecoveryIntervals+1; iter++ {
-		s.advanceLatest(proto.StateProofInterval)
+		s.advanceRoundsWithoutStateProof(proto.StateProofInterval)
 		tx := <-s.txmsg
 		a.Equal(tx.Txn.Type, protocol.StateProofTx)
 	}
@@ -730,7 +929,7 @@ func TestWorkerBuildersRecoveryLimit(t *testing.T) {
 	})
 	a.Equal(proto.StateProofMaxRecoveryIntervals+1, uint64(len(roundSigs)))
 
-	s.advanceLatest(proto.StateProofInterval)
+	s.advanceRoundsWithoutStateProof(proto.StateProofInterval)
 	tx := <-s.txmsg
 	a.Equal(tx.Txn.Type, protocol.StateProofTx)
 
@@ -742,18 +941,19 @@ func TestWorkerBuildersRecoveryLimit(t *testing.T) {
 	err = waitForBuilderAndSignerToWaitOnRound(s)
 	a.NoError(err)
 
-	// should not give up on rounds
-	a.Equal(proto.StateProofMaxRecoveryIntervals+1, uint64(len(w.builders)))
+	// Although the max recovery has passed the worker will not delete
+	// builder and signatures
+	a.Equal(proto.StateProofMaxRecoveryIntervals+2, uint64(len(w.builders)))
 	countDB, err = countBuildersInDB(w.db)
 	a.NoError(err)
-	a.Equal(proto.StateProofMaxRecoveryIntervals+1, uint64(countDB))
+	a.Equal(proto.StateProofMaxRecoveryIntervals+2, uint64(countDB))
 
 	roundSigs = make(map[basics.Round][]pendingSig)
 	err = w.db.Atomic(func(ctx context.Context, tx *sql.Tx) (err error) {
 		roundSigs, err = getPendingSigs(tx)
 		return
 	})
-	a.Equal(proto.StateProofMaxRecoveryIntervals+1, uint64(len(roundSigs)))
+	a.Equal(proto.StateProofMaxRecoveryIntervals+2, uint64(len(roundSigs)))
 }
 
 func waitForBuilderAndSignerToWaitOnRound(s *testWorkerStubs) error {
@@ -933,9 +1133,9 @@ func TestBuilderGeneratesValidStateProofTXN(t *testing.T) {
 	defer w.Shutdown()
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest(proto.StateProofInterval + proto.StateProofInterval/2)
+	s.advanceRoundsWithoutStateProof(proto.StateProofInterval + proto.StateProofInterval/2)
 
-	s.advanceLatest(proto.StateProofInterval)
+	s.advanceRoundsWithoutStateProof(proto.StateProofInterval)
 
 	for i := 0; i < len(keys); i++ {
 		// Expect all signatures to be broadcast.
@@ -1323,7 +1523,7 @@ func TestWorkerHandleSigCorrupt(t *testing.T) {
 	require.Equal(t, network.OutgoingMessage{Action: network.Disconnect}, reply)
 }
 
-func TestWorker_BuildersPersistenceAfterRestart(t *testing.T) {
+func TestBuildersPersistenceAfterRestart(t *testing.T) {
 	partitiontest.PartitionTest(t)
 	a := require.New(t)
 
@@ -1346,7 +1546,7 @@ func TestWorker_BuildersPersistenceAfterRestart(t *testing.T) {
 	const firstExpectedStateproof = 512
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest((expectedStateproofs+1)*proto.StateProofInterval + proto.StateProofInterval/2) // 512, 768, 1024, ... (9 StateProofs)
+	s.advanceRoundsWithoutStateProof((expectedStateproofs+1)*proto.StateProofInterval + proto.StateProofInterval/2) // 512, 768, 1024, ... (9 StateProofs)
 
 	err := waitForBuilderAndSignerToWaitOnRound(s)
 	a.NoError(err)
@@ -1365,7 +1565,7 @@ func TestWorker_BuildersPersistenceAfterRestart(t *testing.T) {
 	compareBuilders(a, expectedStateproofs, w, firstExpectedStateproof, proto)
 }
 
-func TestWorker_OnlySignaturesInDatabase(t *testing.T) {
+func TestWorkerInitOnlySignaturesInDatabase(t *testing.T) {
 	partitiontest.PartitionTest(t)
 	a := require.New(t)
 
@@ -1388,7 +1588,7 @@ func TestWorker_OnlySignaturesInDatabase(t *testing.T) {
 	w.Start()
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]
-	s.advanceLatest((expectedStateproofs+1)*proto.StateProofInterval + proto.StateProofInterval/2) // 512, 768, 1024, ... (9 StateProofs)
+	s.advanceRoundsWithoutStateProof((expectedStateproofs+1)*proto.StateProofInterval + proto.StateProofInterval/2) // 512, 768, 1024, ... (9 StateProofs)
 
 	err := waitForBuilderAndSignerToWaitOnRound(s)
 	a.NoError(err)
@@ -1439,7 +1639,7 @@ func compareBuilders(a *require.Assertions, expectedStateproofs int, w *Worker,
 	}
 }
 
-func TestWorker_LoadsBuilderAndSignatureUponMsgRecv(t *testing.T) {
+func TestWorkerLoadsBuilderAndSignatureUponMsgRecv(t *testing.T) {
 	partitiontest.PartitionTest(t)
 
 	proto := config.Consensus[protocol.ConsensusCurrentVersion]