diff --git a/contrib/sign.sh b/contrib/sign.sh
index 082e967e..2a725320 100755
--- a/contrib/sign.sh
+++ b/contrib/sign.sh
@@ -1,6 +1,8 @@
 #!/bin/sh
 
-if [ $# -eq 0 -o "-h" = "$1" -o "-help" = "$1" -o "--help" = "$1" ]; then
+set -e
+
+if [ $# -ne 2 -o "-h" = "$1" -o "--help" = "$1" -o ! -r "$1" -o ! -r "$2" ]; then
 	cat <<EOHELP
 Usage: $0 <secret> <manifest>
 
@@ -25,16 +27,18 @@ manifest="$2"
 upper="$(mktemp)"
 lower="$(mktemp)"
 
-awk "BEGIN    { sep=0 }
-     /^---\$/ { sep=1; next }
-              { if(sep==0) print > \"$upper\";
-                else       print > \"$lower\"}" \
+trap 'echo rm -f "$upper" "$lower"; rm -f "$upper" "$lower"' EXIT
+
+awk 'BEGIN    { sep=0 }
+     /^---$/ { sep=1; next }
+              { if(sep==0) print > "'"$upper"'";
+                else       print > "'"$lower"'"}' \
     "$manifest"
 
 ecdsasign "$upper" < "$SECRET" >> "$lower"
 
-cat  "$upper"  > "$manifest"
-echo ---      >> "$manifest"
-cat  "$lower" >> "$manifest"
-
-rm -f "$upper" "$lower"
+(
+	cat  "$upper"
+	echo ---
+	cat  "$lower"
+) > "$manifest"