diff --git a/crates/sign/src/windows.rs b/crates/sign/src/windows.rs
index fa3c5378..2bd70d1c 100644
--- a/crates/sign/src/windows.rs
+++ b/crates/sign/src/windows.rs
@@ -31,6 +31,8 @@ impl ExternalKey for WindowsKey {
             PublicKey::P384(_) => p384::ecdsa::Signature::from_slice(&raw)
                 .map(|s| s.to_der().as_bytes().to_vec())
                 .map_err(|e| SignError::Crypto(format!("CNG returned an invalid P-384 signature: {e}"))),
+            // `identities` lists only RSA, P-256 and P-384 store keys; anything else can't sign here.
+            _ => Err(SignError::Unsupported("signing with this key type through the Windows certificate store".into())),
         }
     }
 }
@@ -67,6 +69,8 @@ pub fn identities() -> Result<Vec<DigitalId>, SignError> {
             PublicKey::Rsa { .. } => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Rsa),
             PublicKey::P256(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 256),
             PublicKey::P384(_) => key.algorithm_group().is_ok_and(|a| a == AlgorithmGroup::Ecdsa) && key.bits().is_ok_and(|bits| bits == 384),
+            // Other keys verify signatures but can't sign through CNG here.
+            _ => false,
         };
         if !supported {
             continue;