diff --git a/board/common/Config.in b/board/common/Config.in
index 2bad3d29..1726b757 100644
--- a/board/common/Config.in
+++ b/board/common/Config.in
@@ -18,7 +18,27 @@ endchoice
 config SIGN_KEY
 	string "Signing key"
 	depends on SIGN_ENABLED
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/dev-key" if SIGN_SRC_DIR
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
+
+menuconfig TRUSTED_KEYS
+	bool "Trusted keys for image"
+	depends on SIGN_ENABLED
+	help
+	 Keys that will be accepted for this image
+
+
+config TRUSTED_KEYS_DEVELOPMENT
+	bool "Development key"
+	depends on TRUSTED_KEYS
+
+config TRUSTED_KEYS_DEVELOPMENT_PATH
+	string
+	depends on TRUSTED_KEYS_DEVELOPMENT
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+
+config TRUSTED_KEYS_EXTRA_PATH
+	string "Path to extra keys to include in image"
+	depends on TRUSTED_KEYS
 
 menuconfig DISK_IMAGE
 	bool "Disk image"
@@ -140,4 +160,3 @@ config FIT_ARCH
 config FIT_KERNEL_LOAD_ADDR
 	string "Kernel load address"
 	depends on FIT_IMAGE
-
diff --git a/board/common/common.mk b/board/common/common.mk
index bbe1444e..4fa482bb 100644
--- a/board/common/common.mk
+++ b/board/common/common.mk
@@ -1,11 +1,13 @@
 ifeq ($(SIGN_ENABLED),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk
 
+TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)
 define RAUC_POST_BUILD_INSTALL_CERT
 	@$(call IXMSG,"Installing signing cert for RAUC")
 	mkdir -p $(TARGET_DIR)/etc/rauc/keys
-	$(foreach crt,$(shell ls $(SIGN_KEY)/*.crt), \
+	$(foreach crt,$(shell ls $(TRUSTED_KEYS)), \
 		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
+
 endef
 RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT
 endif
diff --git a/board/common/dev-key/infix.crt b/board/common/signing-keys/development/infix.crt
similarity index 100%
rename from board/common/dev-key/infix.crt
rename to board/common/signing-keys/development/infix.crt
diff --git a/board/common/dev-key/infix.key b/board/common/signing-keys/development/infix.key
similarity index 100%
rename from board/common/dev-key/infix.key
rename to board/common/signing-keys/development/infix.key
diff --git a/configs/aarch64_defconfig b/configs/aarch64_defconfig
index ced47577..17728218 100644
--- a/configs/aarch64_defconfig
+++ b/configs/aarch64_defconfig
@@ -156,3 +156,5 @@ DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
 BR2_PER_PACKAGE_DIRECTORIES=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
diff --git a/configs/x86_64_defconfig b/configs/x86_64_defconfig
index 25fc96ea..b5f67291 100644
--- a/configs/x86_64_defconfig
+++ b/configs/x86_64_defconfig
@@ -157,3 +157,5 @@ BR2_PACKAGE_TETRIS=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
 BR2_PER_PACKAGE_DIRECTORIES=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y