diff --git a/src/cmd_external_sign.rs b/src/cmd_external_sign.rs
index bb020cc..45dd7f2 100644
--- a/src/cmd_external_sign.rs
+++ b/src/cmd_external_sign.rs
@@ -55,6 +55,9 @@ fn sign(sub_arg_matches: &ArgMatches) -> XResult<Vec<u8>> {
     let message_bytes = base64_decode(message_base64)?;
     match key_uri {
         KeyUri::SecureEnclaveKey(key) => {
+            if "ES256" != alg {
+                return simple_error!("Invalid alg: {}", alg);
+            }
             if key.usage != KeyUsage::Singing {
                 simple_error!("Not singing key")
             } else {