diff --git a/keystore2/src/rkpd_client.rs b/keystore2/src/rkpd_client.rs
index bfc7847..aba2c61 100644
--- a/keystore2/src/rkpd_client.rs
+++ b/keystore2/src/rkpd_client.rs
@@ -590,6 +590,9 @@
 
         let new_key =
             get_rkpd_attestation_key(&SecurityLevel::TRUSTED_ENVIRONMENT, key_id).unwrap();
+
+        // Restore original key so that we don't leave RKPD with invalid blobs.
+        assert!(store_rkpd_attestation_key(&sec_level, &new_blob, &key.keyBlob).is_ok());
         assert_eq!(new_key.keyBlob, new_blob);
     }