diff --git a/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb b/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb
index 70342df..1935c67 100644
--- a/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb
+++ b/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb
@@ -9,15 +9,17 @@ PV = "0.1.0"
 
 SRC_URI = "git://github.com/ScottW514/forgectrl.git;protocol=https;branch=main"
 # Pinned; bump deliberately after pushing forgectrl changes.
-SRCREV = "945d85e37bbb4888b1cb12a837b25e6483f1a95d"
+SRCREV = "64bec0edc7e98c0d071ad594c322babe54341d3c"
 
 S = "${WORKDIR}/git"
 
 inherit cmake update-rc.d
 
 DEPENDS += "ulfius jpeg"
-# media-ctl / v4l2-ctl configure the imx-media pipeline at runtime
-RDEPENDS:${PN} = "v4l-utils"
+# media-ctl / v4l2-ctl configure the imx-media pipeline at runtime;
+# the update manager drives ffboot + fwup and verifies against the
+# shipped keyring; release checks and downloads use curl.
+RDEPENDS:${PN} = "v4l-utils ffboot fwup forgefirm-keys curl"
 
 INITSCRIPT_NAME = "forgectrl"
 INITSCRIPT_PARAMS = "defaults 90"
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/forgefirm-release.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/forgefirm-release.pub
new file mode 100644
index 0000000..c15409f
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/forgefirm-release.pub
@@ -0,0 +1 @@
+fHw/N5H/5tuBxjRBS2+r7RRl+ykltrFjsh04y/uFkXU=
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-000.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-000.pub
new file mode 100644
index 0000000..ac9a670
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-000.pub
@@ -0,0 +1 @@
+,md2#U���>0He��!�qW�3���f���
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-001.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-001.pub
new file mode 100644
index 0000000..6a3a9e0
Binary files /dev/null and b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-001.pub differ
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-002.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-002.pub
new file mode 100644
index 0000000..82c0277
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-002.pub
@@ -0,0 +1 @@
+���1)��ˇ�q��qI�,k�nB
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-003.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-003.pub
new file mode 100644
index 0000000..e8ada97
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-003.pub
@@ -0,0 +1 @@
+5x� ms��s��|���al��P�����u���
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-004.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-004.pub
new file mode 100644
index 0000000..0fc1a2f
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-004.pub
@@ -0,0 +1 @@
+��䁮-碥]QG�����5��_�����(
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-005.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-005.pub
new file mode 100644
index 0000000..f7ecb26
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-005.pub
@@ -0,0 +1 @@
+X�Xg��-���xP�87���f|�z9m�c�1
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-006.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-006.pub
new file mode 100644
index 0000000..1553cf4
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-006.pub
@@ -0,0 +1 @@
+׆�gդ
�p�Z���E�Z�D$��"��c5��
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-007.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-007.pub
new file mode 100644
index 0000000..26f1f55
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-007.pub
@@ -0,0 +1 @@
+���0����s�G��CukH����� �1O�Z��
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-008.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-008.pub
new file mode 100644
index 0000000..802a7e3
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-008.pub
@@ -0,0 +1 @@
+�qY\(!�����7�1/?7}2˟8�9�#��@��
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-009.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-009.pub
new file mode 100644
index 0000000..9556b60
Binary files /dev/null and b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-04-009.pub differ
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-05-001.pub b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-05-001.pub
new file mode 100644
index 0000000..f7a1724
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/files/gf/2017-05-001.pub
@@ -0,0 +1 @@
+��tj�1�q��S��1x]f+�Bc���b7U
f�
\ No newline at end of file
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-keys/forgefirm-keys.bb b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/forgefirm-keys.bb
new file mode 100644
index 0000000..1f59350
--- /dev/null
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-keys/forgefirm-keys.bb
@@ -0,0 +1,23 @@
+SUMMARY = "Firmware verification public keys"
+DESCRIPTION = "Trust anchors for firmware archive verification: the \
+ForgeFIRM release-signing public key (verifies release downloads and \
+uploads) and the Glowforge factory keyring (verifies factory .fw \
+archives for cloud restore). Public keys only."
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+
+SRC_URI = " \
+    file://forgefirm-release.pub \
+    file://gf \
+"
+
+S = "${WORKDIR}"
+
+do_install() {
+    install -d ${D}${sysconfdir}/forgefirm/keys/gf
+    install -m 0644 ${WORKDIR}/forgefirm-release.pub \
+        ${D}${sysconfdir}/forgefirm/keys/forgefirm-release.pub
+    install -m 0644 ${WORKDIR}/gf/*.pub ${D}${sysconfdir}/forgefirm/keys/gf/
+}
+
+FILES:${PN} = "${sysconfdir}/forgefirm/keys"