diff --git a/Remote/Glacier.hs b/Remote/Glacier.hs
index e6cd68fdf3..ad5f2e24a7 100644
--- a/Remote/Glacier.hs
+++ b/Remote/Glacier.hs
@@ -56,8 +56,10 @@ gen r u c gc = new <$> remoteCost gc veryExpensiveRemoteCost
 			, retrieveKeyFile = retreiveKeyFileDummy
 			, retrieveKeyFileCheap = retrieveCheap this
 			-- glacier-cli does not follow redirects and does
-			-- not support file://, so this is secure.
-			, retrievalSecurityPolicy = RetrievalAllKeysSecure
+			-- not support file://, as far as we know, but
+			-- there's no guarantee that will continue to be
+			-- the case, so require verifiable keys.
+			, retrievalSecurityPolicy = RetrievalVerifiableKeysSecure
 			, removeKey = removeKeyDummy
 			, lockContent = Nothing
 			, checkPresent = checkPresentDummy