diff --git a/tools/rpmkeys.cc b/tools/rpmkeys.cc
index 731d086d83..9f59b465a7 100644
--- a/tools/rpmkeys.cc
+++ b/tools/rpmkeys.cc
@@ -44,9 +44,12 @@ static struct poptOption optionsTable[] = {
     POPT_TABLEEND
 };
 
-static int matchingKeys(rpmKeyring keyring, ARGV_const_t args, void * userdata, int callback(rpmPubkey, void*))
+static int matchingKeys(rpmts ts, ARGV_const_t args, int callback(rpmPubkey, void*), void * userdata = NULL)
 {
     int ec = EXIT_SUCCESS;
+    rpmKeyring keyring = rpmtsGetKeyring(ts, 1);
+    char * c;
+
     if (args) {
 	for (char * const * arg = args; *arg; arg++) {
 	    int found = false;
@@ -59,6 +62,17 @@ static int matchingKeys(rpmKeyring keyring, ARGV_const_t args, void * userdata,
 		continue;
 	    }
 
+	    /* Check for valid hex chars */
+	    for (c=*arg; *c; c++) {
+		if (strchr("0123456789abcdefABCDEF", *c) == NULL)
+		    break;
+	    }
+	    if (*c) {
+		rpmlog(RPMLOG_ERR, ("invalid key id: %s\n"), *arg);
+		ec = EXIT_FAILURE;
+		continue;
+	    }
+
 	    auto iter = rpmKeyringInitIterator(keyring, 0);
 	    rpmPubkey key = NULL;
 	    while ((key = rpmKeyringIteratorNext(iter))) {
@@ -95,6 +109,7 @@ static int matchingKeys(rpmKeyring keyring, ARGV_const_t args, void * userdata,
 	    ec = EXIT_FAILURE;
 	}
     }
+    rpmKeyringFree(keyring);
     return ec;
 }
 
@@ -113,7 +128,6 @@ int main(int argc, char *argv[])
     poptContext optCon = NULL;
     rpmts ts = NULL;
     ARGV_const_t args = NULL;
-    rpmKeyring keyring = NULL;
 
     optCon = rpmcliInit(argc, argv, optionsTable);
 
@@ -129,7 +143,6 @@ int main(int argc, char *argv[])
 
     ts = rpmtsCreate();
     rpmtsSetRootDir(ts, rpmcliRootDir);
-    keyring = rpmtsGetKeyring(ts, 1);
 
     switch (mode) {
     case MODE_CHECKSIG:
@@ -164,7 +177,7 @@ int main(int argc, char *argv[])
     }
     case MODE_LISTKEY:
     {
-	ec = matchingKeys(keyring, args, NULL, printKey);
+	ec = matchingKeys(ts, args, printKey);
 	break;
     }
     default:
@@ -172,7 +185,6 @@ int main(int argc, char *argv[])
     }
 
 exit:
-    rpmKeyringFree(keyring);
     rpmtsFree(ts);
     rpmcliFini(optCon);
     fflush(stderr);