diff --git a/tools/Android.bp b/tools/Android.bp
index a6a15a5..c480dc2 100644
--- a/tools/Android.bp
+++ b/tools/Android.bp
@@ -59,8 +59,7 @@
     srcs: ["version_policy.c"],
 }
 
-cc_prebuilt_binary {
-    name: "insertkeys.py",
+python_binary_host {
+    name: "insertkeys",
     srcs: ["insertkeys.py"],
-    host_supported: true,
 }
diff --git a/tools/insertkeys.py b/tools/insertkeys.py
index 51b4ab6..24f0dac 100755
--- a/tools/insertkeys.py
+++ b/tools/insertkeys.py
@@ -1,8 +1,8 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 
 from xml.sax import saxutils, handler, make_parser
 from optparse import OptionParser
-import ConfigParser
+import configparser
 import logging
 import base64
 import sys
@@ -32,7 +32,7 @@
         if not os.path.isfile(path):
             sys.exit("Path " + path + " does not exist or is not a file!")
 
-        pkFile = open(path, 'rb').readlines()
+        pkFile = open(path, 'r').readlines()
         base64Key = ""
         lineNo = 1
         certNo = 1
@@ -66,7 +66,7 @@
                 self._base64Key.append(base64Key)
                 try:
                     # Pkgmanager and setool see hex strings with lowercase, lets be consistent
-                    self._base16Key.append(base64.b16encode(base64.b64decode(base64Key)).lower())
+                    self._base16Key.append(base64.b16encode(base64.b64decode(base64Key)).decode('ascii').lower())
                 except TypeError:
                     sys.exit("Invalid certificate, certificate "+ str(certNo) + " found in file: "
                             + path)
@@ -79,7 +79,7 @@
 
             # If we haven't started the certificate, then we should not encounter any data
             elif not inCert:
-                if line is not "":
+                if line != "":
                     sys.exit("Detected erroneous line \""+ line + "\" on " + str(lineNo)
                         + " in pem file: " + path)
 
@@ -107,7 +107,7 @@
     def getBase64Keys(self):
         return self._base64Key
 
-class ParseConfig(ConfigParser.ConfigParser):
+class ParseConfig(configparser.ConfigParser):
 
     # This must be lowercase
     OPTION_WILDCARD_TAG = "all"
@@ -160,15 +160,16 @@
     XML_ENCODING_TAG = '<?xml version="1.0" encoding="iso-8859-1"?>'
 
     def __init__(self, keyMap, out=sys.stdout):
-
         handler.ContentHandler.__init__(self)
         self._keyMap = keyMap
         self._out = out
+
+    def prologue(self):
         self._out.write(ReplaceTags.XML_ENCODING_TAG)
         self._out.write("<!-- AUTOGENERATED FILE DO NOT MODIFY -->")
         self._out.write("<policy>")
 
-    def __del__(self):
+    def epilogue(self):
         self._out.write("</policy>")
 
     def startElement(self, tag, attrs):
@@ -210,8 +211,6 @@
 
 if __name__ == "__main__":
 
-    # Intentional double space to line up equls signs and opening " for
-    # readability.
     usage  = "usage: %prog [options] CONFIG_FILE MAC_PERMISSIONS_FILE [MAC_PERMISSIONS_FILE...]\n"
     usage += "This tool allows one to configure an automatic inclusion\n"
     usage += "of signing keys into the mac_permision.xml file(s) from the\n"
@@ -262,6 +261,9 @@
         logging.info(k + " : " + str(key_map[k]))
     # Generate the XML file with markup replaced with keys
     parser = make_parser()
-    parser.setContentHandler(ReplaceTags(key_map, output_file))
+    handler = ReplaceTags(key_map, output_file)
+    parser.setContentHandler(handler)
+    handler.prologue()
     for f in args[1:]:
         parser.parse(f)
+    handler.epilogue()