diff --git a/README.md b/README.md
index 0e8f46b..ab5cbe9 100644
--- a/README.md
+++ b/README.md
@@ -30,5 +30,12 @@ Replace `runex` with any package in the table. Installing
 `shortarrow-archive-keyring` by name keeps the keyring, and the keys it
 holds up to date, after the tool is removed.
 
+To check the keyring, compare the fingerprints this prints with those on
+<https://pkg.shortarrow.jp/>:
+
+```sh
+curl -fsSL https://pkg.shortarrow.jp/apt/shortarrow-archive-keyring.gpg | gpg --show-keys
+```
+
 The design is in [ADR 0001](docs/adr/0001-package-registry.md), and how
 to run the registry in [docs/operations.md](docs/operations.md).
diff --git a/scripts/PublishedSite.psm1 b/scripts/PublishedSite.psm1
index d0f29b5..a92fe73 100644
--- a/scripts/PublishedSite.psm1
+++ b/scripts/PublishedSite.psm1
@@ -138,6 +138,8 @@ It is maintained by <a href="https://github.com/ShortArrow">ShortArrow</a> and b
 <h2>Keys</h2>
 <p><a href="/apt/shortarrow-archive-keyring.gpg">shortarrow-archive-keyring.gpg</a> holds these public keys.
 The signing key signs the repository; the standby key takes over when the signing key has to be replaced.</p>
+<p>To check a downloaded keyring, compare the fingerprints this prints with the ones below:</p>
+<pre><code>curl -fsSL https://pkg.shortarrow.jp/apt/shortarrow-archive-keyring.gpg | gpg --show-keys</code></pre>
 <ul>
 $($keys -join "`n")
 </ul>
diff --git a/tests/WriteSite.Tests.ps1 b/tests/WriteSite.Tests.ps1
index 47f8270..325ef9a 100644
--- a/tests/WriteSite.Tests.ps1
+++ b/tests/WriteSite.Tests.ps1
@@ -88,6 +88,11 @@ Describe 'Write-Site' -Tag 'gpg' {
         $page | Should -Match 'href="/apt/shortarrow-archive-keyring.gpg"'
     }
 
+    It 'gives on the front page the command that prints the fingerprints of the downloaded keyring' {
+        [System.IO.File]::ReadAllText((Join-Path $site 'index.html')) |
+            Should -Match ([regex]::Escape('curl -fsSL https://pkg.shortarrow.jp/apt/shortarrow-archive-keyring.gpg | gpg --show-keys'))
+    }
+
     It 'puts each architecture''s own entries and the architecture-independent ones in its Packages, and the same text in Packages.gz' {
         $binary = Join-Path $site 'apt' 'dists' 'stable' 'main' 'binary-arm64'
         $text = [System.IO.File]::ReadAllText((Join-Path $binary 'Packages'))