PUBKEY-CM.pub.asc  |  8 ++++++++
 doc/integrity.texi | 20 +++++++++++++++++---
 makedist           | 15 +++++++++++++++

diff --git a/PUBKEY-CM.pub b/PUBKEY-CM.pub
new file mode 100644
index 0000000000000000000000000000000000000000..83ee511824142f7d8daba424be4c0c402abb96af8d3393818ad2d6d379f4c8bd
Binary files /dev/null and b/PUBKEY-CM.pub differ
diff --git a/PUBKEY-CM.pub.asc b/PUBKEY-CM.pub.asc
new file mode 100644
index 0000000000000000000000000000000000000000..82e6607725f6e8ce6e6f56adab1f9deae3debb77beb7434972ecbc6cf13431c9
--- /dev/null
+++ b/PUBKEY-CM.pub.asc
@@ -0,0 +1,8 @@
+-----BEGIN PGP SIGNATURE-----
+
+iJEEABYKADkWIQTbL/jtRAp+lJhvt3bSI36ECQhstwUCadZGCxsUgAAAAAAEAA5t
+YW51MiwyLjUrMS4xMiwyLDMACgkQ0iN+hAkIbLfLVAD/fOsL+S4R8iMK/SU1kvQE
+nT0pXNRtQQVI0VS7r0mIDvoA/jU+olXWazcWTNcN63ScdQ5QIzyMRFlTCRqFpv3K
+wxYL
+=cUbU
+-----END PGP SIGNATURE-----
diff --git a/doc/integrity.texi b/doc/integrity.texi
index dd9573feb0128871071281d9b17965b4c71540835e82c7a7f9b3fdd6d093368c..19f8a5e0714787e1dfda7e6402aac9925d83788cac58b877a5918233d8469dec 100644
--- a/doc/integrity.texi
+++ b/doc/integrity.texi
@@ -8,11 +8,25 @@ You @strong{have to} verify downloaded tarballs authenticity to be sure
 that you retrieved trusted and untampered software.
 
 @url{https://www.openssh.com/, OpenSSH} @file{.sig} signature,
-@url{PUBKEY-SSH.pub, Public key} and its LibrePGP
-@url{PUBKEY-SSH.pub.asc, signature} made with the key above.
+@url{PUBKEY-SSH.pub, public key} and its LibrePGP
+@url{PUBKEY-SSH.pub.asc, signature}.
 Its fingerprint: @code{SHA256:FRiWawVNBkyS3jFn8uZ/JlT+PWKSFbhWe5XSixp1+SY}.
 
 @example
 $ ssh-keygen -Y verify -f PUBKEY-SSH.pub -I releases@@nncpgo.org -n file \
-    -s nncp-@value{VERSION}.tar.zst.sig <nncp-@value{VERSION}.tar.zst
+    -s nncp-@value{VERSION}.tar.xz.sig <nncp-@value{VERSION}.tar.xz
+@end example
+
+@url{http://www.keks.stargrave.org/cm/index.html, KEKS/CM} @file{.cm}
+quantum resistant SLH-DSA signature,
+@url{PUBKEY-CM.pub, public key} and its LibrePGP
+@url{PUBKEY-CM.pub.asc, signature}.
+
+@example
+$ fpr=$(kekspp -v -p /data/id <PUBKEY-CM.pub)
+$ echo $fpr
+54D487664D5C19FE8C63F690155381AD4B0102EB6B9DF5A8DAD7A3B339610608
+$ mkdir -p pubs
+$ ln -s ../PUBKEY-CM.pub pubs/$fpr
+$ cat nncp-$v.tar.xz.cm nncp-$v.tar.xz | cmsigtool -v -d -pubs pubs
 @end example
diff --git a/makedist b/makedist
index c26960c9c774e4cbecb8178a3297867ccb50da88c0e881a965ed16db9392f662..dfe45acbeb523a1e5686fdb1545945f2dff80f2b72cc4fbd2d8ac330e7822582 100755
--- a/makedist
+++ b/makedist
@@ -128,6 +128,21 @@     "6|ru|sftp://anonwww@msk.www.stargrave.org/nncpgo.org/download/$tarball" \
     "6|ru|sftp://anonwww@spb.www.stargrave.org/nncpgo.org/download/$tarball" \
     "ipfs://TODO/$tarball" <$tarball >$tarball.meta4
 mv $tarball.meta4_ $tarball.meta4
+meta4ra-create -add $tarball.meta4 -fn $tarball.cm -hashers "" \
+    -id "KEKS/CM detached signature" \
+    "1|ru|http://www.nncpgo.org/download/$tarball.cm" \
+    "1|ca|https://nncp.mirrors.quux.org/download/$tarball.cm" \
+    "2|ru|http://msk.www.nncpgo.org/download/$tarball.cm" \
+    "2|ru|http://spb.www.nncpgo.org/download/$tarball.cm" \
+    "3|ru|https://www.nncpgo.org/download/$tarball.cm" \
+    "4|ru|https://msk.www.nncpgo.org/download/$tarball.cm" \
+    "4|ru|https://spb.www.nncpgo.org/download/$tarball.cm" \
+    "5|ru|http://y.www.nncpgo.org/download/$tarball.cm" \
+    "5|ru|http://[322:3bd:cc26:9545:b00b:ec74:34f6:bf47]/download/$tarball.cm" \
+    "6|ru|sftp://anonwww@msk.www.stargrave.org/nncpgo.org/download/$tarball.cm" \
+    "6|ru|sftp://anonwww@spb.www.stargrave.org/nncpgo.org/download/$tarball.cm" \
+    "ipfs://TODO/$tarball.cm" <$tarball.cm >$tarball.meta4_
+mv $tarball.meta4_ $tarball.meta4
 meta4ra-create -add $tarball.meta4 -fn $tarball.sig -hashers "" \
     -id "OpenSSH signature" \
     "1|ru|http://www.nncpgo.org/download/$tarball.sig" \