diff --git a/Annex/Transfer.hs b/Annex/Transfer.hs
index d31863f2b8..9eeecb7834 100644
--- a/Annex/Transfer.hs
+++ b/Annex/Transfer.hs
@@ -276,7 +276,7 @@ runTransferrer sd r k afile retrydecider direction _witness =
 preCheckSecureHashes :: Observable v => Key -> Maybe Backend -> Annex v -> Annex v
 preCheckSecureHashes k meventualbackend a = case meventualbackend of
 	Just eventualbackend -> go
-		(pure (Types.Backend.isCryptographicallySecure eventualbackend))
+		(Types.Backend.isCryptographicallySecure eventualbackend)
 		(Types.Backend.backendVariety eventualbackend)
 	Nothing -> go
 		(isCryptographicallySecure k)
diff --git a/Backend.hs b/Backend.hs
index 0137993674..a65a3cf4b6 100644
--- a/Backend.hs
+++ b/Backend.hs
@@ -124,8 +124,8 @@ isStableKey k = maybe False (`B.isStableKey` k)
 	<$> maybeLookupBackendVariety (fromKey keyVariety k)
 
 isCryptographicallySecure :: Key -> Annex Bool
-isCryptographicallySecure k = maybe False isCryptographicallySecure'
-	<$> maybeLookupBackendVariety (fromKey keyVariety k)
+isCryptographicallySecure k = maybe (pure False) isCryptographicallySecure'
+	=<< maybeLookupBackendVariety (fromKey keyVariety k)
 
-isCryptographicallySecure' :: Backend -> Bool
+isCryptographicallySecure' :: Backend -> Annex Bool
 isCryptographicallySecure' = B.isCryptographicallySecure
diff --git a/Backend/External.hs b/Backend/External.hs
index b0cdd0cefd..3feffd1ee1 100644
--- a/Backend/External.hs
+++ b/Backend/External.hs
@@ -72,7 +72,7 @@ makeBackend' ebname@(ExternalBackendName bname) hasext (Right p) = do
 		, canUpgradeKey = Nothing
 		, fastMigrate = Nothing
 		, isStableKey = const isstable
-		, isCryptographicallySecure = iscryptographicallysecure
+		, isCryptographicallySecure = pure iscryptographicallysecure
 		}
 makeBackend' ebname hasext (Left _) = return $ unavailBackend ebname hasext
 
@@ -86,7 +86,7 @@ unavailBackend (ExternalBackendName bname) hasext =
 		, canUpgradeKey = Nothing
 		, fastMigrate = Nothing
 		, isStableKey = const False
-		, isCryptographicallySecure = False
+		, isCryptographicallySecure = pure False
 		}
 
 genKeyExternal :: ExternalBackendName -> HasExt -> KeySource -> MeterUpdate -> Annex Key
diff --git a/Backend/Hash.hs b/Backend/Hash.hs
index 0c4ad61a0d..e6a20bb7e0 100644
--- a/Backend/Hash.hs
+++ b/Backend/Hash.hs
@@ -81,7 +81,7 @@ genBackend hash = Backend
 	, canUpgradeKey = Just needsUpgrade
 	, fastMigrate = Just trivialMigrate
 	, isStableKey = const True
-	, isCryptographicallySecure = cryptographicallySecure hash
+	, isCryptographicallySecure = pure $ cryptographicallySecure hash
 	}
 
 genBackendE :: Hash -> Backend
diff --git a/Backend/URL.hs b/Backend/URL.hs
index 209c6c843b..0eeadaa289 100644
--- a/Backend/URL.hs
+++ b/Backend/URL.hs
@@ -31,7 +31,7 @@ backendURL = Backend
 	-- The content of an url can change at any time, so URL keys are
 	-- not stable.
 	, isStableKey = const False
-	, isCryptographicallySecure = False
+	, isCryptographicallySecure = pure False
 	}
 
 backendVURL :: Backend
@@ -48,7 +48,7 @@ backendVURL = Backend
 	-- can be more than one hash and different versions of the content.
 	-- So the content is not stable.
 	, isStableKey = const False
-	, isCryptographicallySecure = False 
+	, isCryptographicallySecure = pure False 
 	-- TODO it is when all recorded hashes are
 	}
 
diff --git a/Backend/WORM.hs b/Backend/WORM.hs
index 9d4fa01d49..5ea825791c 100644
--- a/Backend/WORM.hs
+++ b/Backend/WORM.hs
@@ -32,7 +32,7 @@ backend = Backend
 	, canUpgradeKey = Just needsUpgrade
 	, fastMigrate = Just removeProblemChars
 	, isStableKey = const True
-	, isCryptographicallySecure = False
+	, isCryptographicallySecure = pure False
 	}
 
 {- The key includes the file size, modification time, and the
diff --git a/Remote/Web.hs b/Remote/Web.hs
index b1ab61dff2..827614671f 100644
--- a/Remote/Web.hs
+++ b/Remote/Web.hs
@@ -171,9 +171,10 @@ downloadKey urlincludeexclude key _af dest p vc =
 		-- Make sure to pick a backend that is cryptographically
 		-- secure.
 		db <- defaultBackend
-		let b = if isCryptographicallySecure' db
-			then db
-			else defaultHashBackend
+		b <- ifM (isCryptographicallySecure' db)
+			( pure db
+			, pure defaultHashBackend
+			)
 		showSideAction (UnquotedString descChecksum)
 		(hashk, _) <- genKey ks nullMeterUpdate b
 		unless (hashk `elem` eks) $
diff --git a/Types/Backend.hs b/Types/Backend.hs
index e244bbe4d1..37e6561490 100644
--- a/Types/Backend.hs
+++ b/Types/Backend.hs
@@ -34,7 +34,7 @@ data BackendA a = Backend
 	-- same data.
 	, isStableKey :: Key -> Bool
 	-- Checks if a key is verified using a cryptographically secure hash.
-	, isCryptographicallySecure :: Bool
+	, isCryptographicallySecure :: a Bool
 	}
 
 instance Show (BackendA a) where