diff --git a/main.go b/main.go
index c9d2427c..0b76e683 100644
--- a/main.go
+++ b/main.go
@@ -4,11 +4,13 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"strings"
 	"text/tabwriter"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/docker/distribution/digest"
 	"github.com/docker/docker/cliconfig"
 	"github.com/docker/engine-api/types"
 	"github.com/jessfraz/reg/registry"
@@ -149,7 +151,6 @@ func main() {
 					return err
 				}
 
-				// print the tags
 				fmt.Println(string(b))
 
 				return nil
@@ -175,26 +176,37 @@ func main() {
 			},
 		},
 		{
-			Name:  "timestamp",
-			Usage: "get the notary timestamp for the specific reference of a repository",
+			Name:    "download",
+			Aliases: []string{"layer"},
+			Usage:   "download a layer for the specific reference of a repository",
+			Flags: []cli.Flag{
+				cli.StringFlag{
+					Name:  "output, o",
+					Usage: "output file, default to stdout",
+				},
+			},
 			Action: func(c *cli.Context) error {
 				repo, ref, err := getRepoAndRef(c)
 				if err != nil {
 					return err
 				}
 
-				timestamp, err := r.NotaryTimestamp(repo, ref)
+				layer, err := r.DownloadLayer(repo, digest.Digest(ref))
+				if err != nil {
+					return err
+				}
+				defer layer.Close()
+
+				b, err := ioutil.ReadAll(layer)
 				if err != nil {
 					return err
 				}
 
-				b, err := json.MarshalIndent(timestamp, " ", "  ")
-				if err != nil {
-					return err
+				if c.String("output") != "" {
+					return ioutil.WriteFile(c.String("output"), b, 0644)
 				}
 
-				// print the tags
-				fmt.Println(string(b))
+				fmt.Fprint(os.Stdout, string(b))
 
 				return nil
 			},
diff --git a/registry/manifest.go b/registry/manifest.go
index f7fd443e..83f16e7c 100644
--- a/registry/manifest.go
+++ b/registry/manifest.go
@@ -1,7 +1,6 @@
 package registry
 
 import (
-	"log"
 	"strings"
 
 	"github.com/docker/distribution/manifest/schema1"
@@ -21,7 +20,7 @@ func (r *Registry) Manifest(repository, ref string) (interface{}, error) {
 
 	if !strings.Contains(ref, ":") {
 		// we got a tag, get the manifest for the ref
-		log.Printf("ref: %s", h.Get("Docker-Content-Digest"))
+		r.Logf("ref: %s", h.Get("Docker-Content-Digest"))
 	}
 
 	if m.Versioned.SchemaVersion == 1 {
diff --git a/registry/notary.go b/registry/notary.go
deleted file mode 100644
index b21c25db..00000000
--- a/registry/notary.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package registry
-
-// NotaryTimestamp returns a notary timestamp for a specific repository:tag.
-func (r *Registry) NotaryTimestamp(repository, ref string) (interface{}, error) {
-	url := r.url("/v2/%s/%s/_trust/tuf/timestamp.json", r.Domain, repository)
-	r.Logf("registry.manifests url=%s repository=%s ref=%s", url, repository, ref)
-
-	var ts interface{}
-	_, err := r.getJSON(url, &ts)
-	if err != nil {
-		return ts, err
-	}
-
-	return ts, nil
-}
diff --git a/registry/tokentransport.go b/registry/tokentransport.go
index bbb5c2fe..f58f4baa 100644
--- a/registry/tokentransport.go
+++ b/registry/tokentransport.go
@@ -91,6 +91,7 @@ func (a *authService) Request(username, password string) (*http.Request, error)
 	for _, s := range a.Scope {
 		q.Set("scope", s)
 	}
+	//	q.Set("scope", "repository:r.j3ss.co/htop:push,pull")
 	a.Realm.RawQuery = q.Encode()
 
 	req, err := http.NewRequest("GET", a.Realm.String(), nil)