diff --git a/src/libostree/ostree-repo-finder-avahi.c b/src/libostree/ostree-repo-finder-avahi.c
index 4de74c6e60..409fcae830 100644
--- a/src/libostree/ostree-repo-finder-avahi.c
+++ b/src/libostree/ostree-repo-finder-avahi.c
@@ -165,28 +165,28 @@ ostree_avahi_browser_event_to_string (AvahiBrowserEvent event)
 typedef struct
 {
   gchar *uri;
-  gchar *keyring;
+  OstreeRemote *keyring_remote;  /* (owned) */
 } UriAndKeyring;
 
 static void
 uri_and_keyring_free (UriAndKeyring *data)
 {
   g_free (data->uri);
-  g_free (data->keyring);
+  ostree_remote_unref (data->keyring_remote);
   g_free (data);
 }
 
 G_DEFINE_AUTOPTR_CLEANUP_FUNC (UriAndKeyring, uri_and_keyring_free)
 
 static UriAndKeyring *
-uri_and_keyring_new (const gchar *uri,
-                     const gchar *keyring)
+uri_and_keyring_new (const gchar  *uri,
+                     OstreeRemote *keyring_remote)
 {
   g_autoptr(UriAndKeyring) data = NULL;
 
   data = g_new0 (UriAndKeyring, 1);
   data->uri = g_strdup (uri);
-  data->keyring = g_strdup (keyring);
+  data->keyring_remote = ostree_remote_ref (keyring_remote);
 
   return g_steal_pointer (&data);
 }
@@ -196,7 +196,7 @@ uri_and_keyring_hash (gconstpointer key)
 {
   const UriAndKeyring *_key = key;
 
-  return g_str_hash (_key->uri) ^ g_str_hash (_key->keyring);
+  return g_str_hash (_key->uri) ^ g_str_hash (_key->keyring_remote->keyring);
 }
 
 static gboolean
@@ -205,7 +205,8 @@ uri_and_keyring_equal (gconstpointer a,
 {
   const UriAndKeyring *_a = a, *_b = b;
 
-  return g_str_equal (_a->uri, _b->uri) && g_str_equal (_a->keyring, _b->keyring);
+  return (g_str_equal (_a->uri, _b->uri) &&
+          g_str_equal (_a->keyring_remote->keyring, _b->keyring_remote->keyring));
 }
 
 /* This must return a valid remote name (suitable for use in a refspec). */
@@ -213,7 +214,7 @@ static gchar *
 uri_and_keyring_to_name (UriAndKeyring *data)
 {
   g_autofree gchar *escaped_uri = g_uri_escape_string (data->uri, NULL, FALSE);
-  g_autofree gchar *escaped_keyring = g_uri_escape_string (data->keyring, NULL, FALSE);
+  g_autofree gchar *escaped_keyring = g_uri_escape_string (data->keyring_remote->keyring, NULL, FALSE);
 
   /* FIXME: Need a better separator than `_`, since it’s not escaped in the input. */
   g_autofree gchar *out = g_strdup_printf ("%s_%s", escaped_uri, escaped_keyring);
@@ -770,14 +771,15 @@ ostree_avahi_service_build_repo_finder_result (OstreeAvahiService
   for (i = 0; i < possible_refs->len; i++)
     {
       const OstreeCollectionRef *ref = g_ptr_array_index (possible_refs, i);
-      g_autofree gchar *keyring = NULL;
       g_autoptr(UriAndKeyring) resolved_repo = NULL;
+      g_autoptr(OstreeRemote) keyring_remote = NULL;
 
       /* Look up the GPG keyring for this ref. */
-      keyring = ostree_repo_resolve_keyring_for_collection (parent_repo, ref->collection_id,
-                                                            cancellable, &error);
+      keyring_remote = ostree_repo_resolve_keyring_for_collection (parent_repo,
+                                                                   ref->collection_id,
+                                                                   cancellable, &error);
 
-      if (keyring == NULL)
+      if (keyring_remote == NULL)
         {
           g_debug ("Ignoring ref (%s, %s) on host ‘%s’ due to missing keyring: %s",
                    ref->collection_id, refs[i]->ref_name, service->address,
@@ -788,10 +790,11 @@ ostree_avahi_service_build_repo_finder_result (OstreeAvahiService
 
       /* Add this repo to the results, keyed by the canonicalised repository URI
        * to deduplicate the results. */
-      g_debug ("Resolved ref (%s, %s) to repo URI ‘%s’ with keyring ‘%s’.",
-               ref->collection_id, ref->ref_name, uri, keyring);
+      g_debug ("Resolved ref (%s, %s) to repo URI ‘%s’ with keyring ‘%s’ from remote ‘%s’.",
+               ref->collection_id, ref->ref_name, uri, keyring_remote->keyring,
+               keyring_remote->name);
 
-      resolved_repo = uri_and_keyring_new (uri, keyring);
+      resolved_repo = uri_and_keyring_new (uri, keyring_remote);
 
       supported_ref_to_checksum = g_hash_table_lookup (repo_to_refs, resolved_repo);
 
@@ -821,7 +824,7 @@ ostree_avahi_service_build_repo_finder_result (OstreeAvahiService
       remote = ostree_remote_new (name);
 
       g_clear_pointer (&remote->keyring, g_free);
-      remote->keyring = g_strdup (repo->keyring);
+      remote->keyring = g_strdup (repo->keyring_remote->keyring);
 
       /* gpg-verify-summary is false since we use the unsigned summary file support. */
       g_key_file_set_string (remote->options, remote->group, "url", repo->uri);
diff --git a/src/libostree/ostree-repo-finder-mount.c b/src/libostree/ostree-repo-finder-mount.c
index 5784b9862c..7dcbab892b 100644
--- a/src/libostree/ostree-repo-finder-mount.c
+++ b/src/libostree/ostree-repo-finder-mount.c
@@ -93,28 +93,28 @@ G_DEFINE_TYPE_WITH_CODE (OstreeRepoFinderMount, ostree_repo_finder_mount, G_TYPE
 typedef struct
 {
   gchar *uri;
-  gchar *keyring;
+  OstreeRemote *keyring_remote;  /* (owned) */
 } UriAndKeyring;
 
 static void
 uri_and_keyring_free (UriAndKeyring *data)
 {
   g_free (data->uri);
-  g_free (data->keyring);
+  ostree_remote_unref (data->keyring_remote);
   g_free (data);
 }
 
 G_DEFINE_AUTOPTR_CLEANUP_FUNC (UriAndKeyring, uri_and_keyring_free)
 
 static UriAndKeyring *
-uri_and_keyring_new (const gchar *uri,
-                     const gchar *keyring)
+uri_and_keyring_new (const gchar  *uri,
+                     OstreeRemote *keyring_remote)
 {
   g_autoptr(UriAndKeyring) data = NULL;
 
   data = g_new0 (UriAndKeyring, 1);
   data->uri = g_strdup (uri);
-  data->keyring = g_strdup (keyring);
+  data->keyring_remote = ostree_remote_ref (keyring_remote);
 
   return g_steal_pointer (&data);
 }
@@ -124,7 +124,7 @@ uri_and_keyring_hash (gconstpointer key)
 {
   const UriAndKeyring *_key = key;
 
-  return g_str_hash (_key->uri) ^ g_str_hash (_key->keyring);
+  return g_str_hash (_key->uri) ^ g_str_hash (_key->keyring_remote->keyring);
 }
 
 static gboolean
@@ -133,7 +133,8 @@ uri_and_keyring_equal (gconstpointer a,
 {
   const UriAndKeyring *_a = a, *_b = b;
 
-  return g_str_equal (_a->uri, _b->uri) && g_str_equal (_a->keyring, _b->keyring);
+  return (g_str_equal (_a->uri, _b->uri) &&
+          g_str_equal (_a->keyring_remote->keyring, _b->keyring_remote->keyring));
 }
 
 /* This must return a valid remote name (suitable for use in a refspec). */
@@ -141,7 +142,7 @@ static gchar *
 uri_and_keyring_to_name (UriAndKeyring *data)
 {
   g_autofree gchar *escaped_uri = g_uri_escape_string (data->uri, NULL, FALSE);
-  g_autofree gchar *escaped_keyring = g_uri_escape_string (data->keyring, NULL, FALSE);
+  g_autofree gchar *escaped_keyring = g_uri_escape_string (data->keyring_remote->keyring, NULL, FALSE);
 
   /* FIXME: Need a better separator than `_`, since it’s not escaped in the input. */
   g_autofree gchar *out = g_strdup_printf ("%s_%s", escaped_uri, escaped_keyring);
@@ -439,7 +440,6 @@ ostree_repo_finder_mount_resolve_async (OstreeRepoFinder                  *finde
         {
           const OstreeCollectionRef *ref = refs[i];
           g_autofree gchar *resolved_repo_uri = NULL;
-          g_autofree gchar *keyring = NULL;
           g_autoptr(UriAndKeyring) resolved_repo = NULL;
 
           for (gsize j = 0; j < repos_refs->len; j++)
@@ -448,6 +448,7 @@ ostree_repo_finder_mount_resolve_async (OstreeRepoFinder                  *finde
               OstreeRepo *repo = repo_and_refs->repo;
               GHashTable *repo_refs = repo_and_refs->refs;
               g_autofree char *repo_path = g_file_get_path (ostree_repo_get_path (repo));
+              g_autoptr(OstreeRemote) keyring_remote = NULL;
 
               const gchar *checksum = g_hash_table_lookup (repo_refs, ref);
 
@@ -460,10 +461,11 @@ ostree_repo_finder_mount_resolve_async (OstreeRepoFinder                  *finde
                 }
 
               /* Finally, look up the GPG keyring for this ref. */
-              keyring = ostree_repo_resolve_keyring_for_collection (parent_repo, ref->collection_id,
-                                                                    cancellable, &local_error);
+              keyring_remote = ostree_repo_resolve_keyring_for_collection (parent_repo,
+                                                                           ref->collection_id,
+                                                                           cancellable, &local_error);
 
-              if (keyring == NULL)
+              if (keyring_remote == NULL)
                 {
                   g_debug ("Ignoring repository ‘%s’ when looking for ref (%s, %s) on mount ‘%s’ due to missing keyring: %s",
                            repo_path, ref->collection_id, ref->ref_name, mount_name, local_error->message);
@@ -477,10 +479,11 @@ ostree_repo_finder_mount_resolve_async (OstreeRepoFinder                  *finde
                * to deduplicate the results. */
               g_autofree char *canonical_repo_path = realpath (repo_path, NULL);
               resolved_repo_uri = g_strconcat ("file://", canonical_repo_path, NULL);
-              g_debug ("Resolved ref (%s, %s) on mount ‘%s’ to repo URI ‘%s’ with keyring ‘%s’.",
-                       ref->collection_id, ref->ref_name, mount_name, resolved_repo_uri, keyring);
+              g_debug ("Resolved ref (%s, %s) on mount ‘%s’ to repo URI ‘%s’ with keyring ‘%s’ from remote ‘%s’.",
+                       ref->collection_id, ref->ref_name, mount_name, resolved_repo_uri,
+                       keyring_remote->keyring, keyring_remote->name);
 
-              resolved_repo = uri_and_keyring_new (resolved_repo_uri, keyring);
+              resolved_repo = uri_and_keyring_new (resolved_repo_uri, keyring_remote);
 
               supported_ref_to_checksum = g_hash_table_lookup (repo_to_refs, resolved_repo);
 
@@ -513,7 +516,7 @@ ostree_repo_finder_mount_resolve_async (OstreeRepoFinder                  *finde
           remote = ostree_remote_new (name);
 
           g_clear_pointer (&remote->keyring, g_free);
-          remote->keyring = g_strdup (repo->keyring);
+          remote->keyring = g_strdup (repo->keyring_remote->keyring);
 
           /* gpg-verify-summary is false since we use the unsigned summary file support. */
           g_key_file_set_string (remote->options, remote->group, "url", repo->uri);
diff --git a/src/libostree/ostree-repo-pull.c b/src/libostree/ostree-repo-pull.c
index cad7f86e60..4401d76315 100644
--- a/src/libostree/ostree-repo-pull.c
+++ b/src/libostree/ostree-repo-pull.c
@@ -5498,7 +5498,7 @@ check_remote_matches_collection_id (OstreeRepo  *repo,
  * Find the GPG keyring for the given @collection_id, using the local
  * configuration from the given #OstreeRepo. This will search the configured
  * remotes for ones whose `collection-id` key matches @collection_id, and will
- * return the GPG keyring from the first matching remote.
+ * return the first matching remote.
  *
  * If multiple remotes match and have different keyrings, a debug message will
  * be emitted, and the first result will be returned. It is expected that the
@@ -5506,10 +5506,11 @@ check_remote_matches_collection_id (OstreeRepo  *repo,
  *
  * If no match can be found, a %G_IO_ERROR_NOT_FOUND error will be returned.
  *
- * Returns: (transfer full): filename of the GPG keyring for @collection_id
+ * Returns: (transfer full): #OstreeRemote containing the GPG keyring for
+ *    @collection_id
  * Since: 2017.8
  */
-gchar *
+OstreeRemote *
 ostree_repo_resolve_keyring_for_collection (OstreeRepo    *self,
                                             const gchar   *collection_id,
                                             GCancellable  *cancellable,
@@ -5517,7 +5518,7 @@ ostree_repo_resolve_keyring_for_collection (OstreeRepo    *self,
 {
   gsize i;
   g_auto(GStrv) remotes = NULL;
-  const OstreeRemote *keyring_remote = NULL;
+  OstreeRemote *keyring_remote = NULL;
 
   g_return_val_if_fail (OSTREE_IS_REPO (self), NULL);
   g_return_val_if_fail (ostree_validate_collection_id (collection_id, NULL), NULL);
@@ -5567,7 +5568,7 @@ ostree_repo_resolve_keyring_for_collection (OstreeRepo    *self,
     }
 
   if (keyring_remote != NULL)
-    return g_strdup (keyring_remote->keyring);
+    return ostree_remote_ref (keyring_remote);
   else
     {
       g_set_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND,
diff --git a/src/libostree/ostree-repo.h b/src/libostree/ostree-repo.h
index a2986e6ddc..990573e76d 100644
--- a/src/libostree/ostree-repo.h
+++ b/src/libostree/ostree-repo.h
@@ -1208,10 +1208,10 @@ gboolean ostree_repo_pull_from_remotes_finish (OstreeRepo    *self,
                                                GError       **error);
 
 _OSTREE_PUBLIC
-gchar *ostree_repo_resolve_keyring_for_collection (OstreeRepo    *self,
-                                                   const gchar   *collection_id,
-                                                   GCancellable  *cancellable,
-                                                   GError       **error);
+OstreeRemote *ostree_repo_resolve_keyring_for_collection (OstreeRepo    *self,
+                                                          const gchar   *collection_id,
+                                                          GCancellable  *cancellable,
+                                                          GError       **error);
 
 _OSTREE_PUBLIC
 gboolean ostree_repo_list_collection_refs (OstreeRepo                 *self,