diff --git a/Cargo.toml b/Cargo.toml
index 0c2ee089f..0f569852b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,3 +2,4 @@
 resolver = "2"
 
 members = ["beacon-api-client", "ethereum-consensus", "test-gen", "spec-gen"]
+default-members = ["ethereum-consensus"]
diff --git a/ethereum-consensus/Cargo.toml b/ethereum-consensus/Cargo.toml
index 466ac00e4..ff8bb41ee 100644
--- a/ethereum-consensus/Cargo.toml
+++ b/ethereum-consensus/Cargo.toml
@@ -9,8 +9,11 @@ license = "MIT OR Apache-2.0"
 default = ["serde", "async"]
 serde = ["hex", "serde_json", "serde_yaml"]
 async = ["tokio", "tokio-stream", "async-stream"]
-spec-tests = ["serde", "serde_yaml"]
+spec-tests = ["serde", "serde_yaml", "secret-key-debug"]
+# enable if you want to be able to print `crypto::SecretKey`
+secret-key-debug = []
 ec = [
+    "secret-key-debug",
     "clap",
     "eyre",
     "bip39",
diff --git a/ethereum-consensus/src/bin/ec/bls.rs b/ethereum-consensus/src/bin/ec/bls.rs
new file mode 100644
index 000000000..c2e31877d
--- /dev/null
+++ b/ethereum-consensus/src/bin/ec/bls.rs
@@ -0,0 +1,18 @@
+use clap::Args;
+use ethereum_consensus::crypto::SecretKey;
+use rand::prelude::*;
+
+#[derive(Debug, Args)]
+#[clap(about = "generate a random BLS12-381 keypair")]
+pub struct Command;
+
+impl Command {
+    pub fn execute(self) -> eyre::Result<()> {
+        let mut rng = thread_rng();
+        let secret_key = SecretKey::random(&mut rng).unwrap();
+        let public_key = secret_key.public_key();
+        println!("secret key: {secret_key:?}");
+        println!("public key: {public_key:?}");
+        Ok(())
+    }
+}
diff --git a/ethereum-consensus/src/bin/ec/main.rs b/ethereum-consensus/src/bin/ec/main.rs
index 82210fe8b..80187031e 100644
--- a/ethereum-consensus/src/bin/ec/main.rs
+++ b/ethereum-consensus/src/bin/ec/main.rs
@@ -1,3 +1,4 @@
+mod bls;
 mod validator;
 
 use clap::{Parser, Subcommand};
@@ -5,6 +6,7 @@ use clap::{Parser, Subcommand};
 #[derive(Debug, Subcommand)]
 pub enum Commands {
     Validator(validator::Command),
+    Bls(bls::Command),
 }
 
 #[derive(Debug, Parser)]
@@ -19,5 +21,6 @@ fn main() -> eyre::Result<()> {
 
     match cli.command {
         Commands::Validator(cmd) => cmd.execute(),
+        Commands::Bls(cmd) => cmd.execute(),
     }
 }
diff --git a/ethereum-consensus/src/crypto.rs b/ethereum-consensus/src/crypto.rs
index 454509cba..6bba383fe 100644
--- a/ethereum-consensus/src/crypto.rs
+++ b/ethereum-consensus/src/crypto.rs
@@ -160,17 +160,24 @@ pub fn eth_fast_aggregate_verify(
 }
 
 #[derive(Clone, Default, serde::Deserialize)]
-#[cfg_attr(feature = "spec-tests", derive(Debug))]
 #[serde(try_from = "String")]
 pub struct SecretKey(bls_impl::SecretKey);
 
-#[cfg(not(feature = "spec-tests"))]
+#[cfg(not(feature = "secret-key-debug"))]
 impl fmt::Debug for SecretKey {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         f.debug_tuple("SecretKey").finish()
     }
 }
 
+#[cfg(feature = "secret-key-debug")]
+impl fmt::Debug for SecretKey {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let inner = Bytes32::try_from(self.0.to_bytes().as_ref()).unwrap();
+        write!(f, "{inner:?}")
+    }
+}
+
 #[cfg(feature = "serde")]
 impl TryFrom<String> for SecretKey {
     type Error = Error;