diff --git a/getuto b/getuto
index a5f6ac4..db709f2 100755
--- a/getuto
+++ b/getuto
@@ -77,7 +77,9 @@ getuto_refresh() {
 		done
 		# We only sign (-> ultimate trust) the keys we originally import, so this is fine and
 		# just serves as an additional refresh method.
-		gpg ${QUIET_GPG} --auto-key-locate=clear,nodefault,wkd --locate-key releng@gentoo.org infrastructure@gentoo.org repomirrorci@gentoo.org || true
+		gpg --with-colons --list-keys | grep "^uid" | cut -d: -f10 | \
+			sed -n 's/.*<\([^>]\+@[^>]\+\.[^>]\+\)>.*/\1/p' | sort -u | \
+			xargs gpg ${QUIET_GPG} --auto-key-locate=clear,nodefault,wkd --locate-key || true
 
 		touch ${LASTRUNFILE}
 	else
@@ -163,7 +165,9 @@ if [[ ! -d ${GNUPGHOME} ]] ; then
 	done
 	# We only sign (-> ultimate trust) the keys we originally import, so this is fine and
 	# just serves as an additional refresh method.
-	gpg ${QUIET_GPG} --auto-key-locate=clear,nodefault,wkd --locate-key releng@gentoo.org infrastructure@gentoo.org repomirrorci@gentoo.org || true
+	gpg --with-colons --list-keys | grep "^uid" | cut -d: -f10 | \
+			sed -n 's/.*<\([^>]\+@[^>]\+\.[^>]\+\)>.*/\1/p' | sort -u | \
+			xargs gpg ${QUIET_GPG} --auto-key-locate=clear,nodefault,wkd --locate-key || true
 
 	# Locally sign all release engineering keys.
 	for relkeyid in ${myrelkeys} ; do