diff --git a/core/tools/keyctl-proxy b/core/tools/keyctl-proxy
index 5b49ba858b..0e14ebe623 100755
--- a/core/tools/keyctl-proxy
+++ b/core/tools/keyctl-proxy
@@ -93,10 +93,10 @@ class KeyctlProxy:
 @click.option(
     "-l", "--listen", "ipaddr", default="0.0.0.0", help="Bind to particular ip address"
 )
-@click.option("-t", "--header-type", type=click.Choice(indexmap.keys()))
+@click.option("-t", "--header-type", "fw_or_type", type=click.Choice(indexmap.keys()))
 @click.option("-d", "--digest")
 @click.argument("fw_file", type=click.File("rb"), required=False)
-def cli(ipaddr, fw_file, header_type, digest):
+def cli(ipaddr, fw_file, fw_or_type, digest):
     """Participate in signing of firmware.
 
     Specify either fw_file to auto-detect type and digest, or use -t and -d to specify
@@ -104,20 +104,20 @@ def cli(ipaddr, fw_file, header_type, digest):
     """
     public_keys = None
     if fw_file:
-        if header_type or digest:
+        if fw_or_type or digest:
             raise click.ClickException("Do not specify fw_file together with -t/-d")
 
-        fw = parse_image(fw_file.read())
-        digest = fw.digest()
-        public_keys = fw.public_keys
+        fw_or_type = parse_image(fw_file.read())
+        digest = fw_or_type.digest()
+        public_keys = fw_or_type.public_keys
 
-        click.echo(fw.format())
+        click.echo(fw_or_type.format())
 
-    if not fw_file and (not header_type or not digest):
+    if not fw_file and (not fw_or_type or not digest):
         raise click.ClickException("Please specify either fw_file or -t and -h")
 
     while True:
-        pubkey, R = make_commit(header_type.BIP32_INDEX, digest)
+        pubkey, R = make_commit(fw_or_type.NAME, fw_or_type.BIP32_INDEX, digest)
         if public_keys is not None and pubkey not in public_keys:
             click.echo(f"\n\nPublic key {pubkey.hex()} is unknown.")
             if click.confirm("Retry with a different passphrase?"):
@@ -125,7 +125,7 @@ def cli(ipaddr, fw_file, header_type, digest):
         break
 
     daemon = Pyro4.Daemon(host=ipaddr, port=PORT)
-    proxy = KeyctlProxy(header_type, digest, (pubkey, R))
+    proxy = KeyctlProxy(fw_or_type, digest, (pubkey, R))
     uri = daemon.register(proxy, "keyctl")
     click.echo(f"keyctl-proxy running at URI: {uri}")
     click.echo("Press Ctrl+C to abort.")