diff --git a/delta_performer_unittest.cc b/delta_performer_unittest.cc
index 4b273cc..cceffcf 100755
--- a/delta_performer_unittest.cc
+++ b/delta_performer_unittest.cc
@@ -100,21 +100,22 @@
   kSignatureGenerator,  // Sign the payload at generation time.
   kSignatureGenerated,  // Sign the payload after it's generated.
   kSignatureGeneratedShell,  // Sign the generated payload through shell cmds.
+  kSignatureGeneratedShellBadKey,  // Sign with a bad key through shell cmds.
 };
 
-size_t GetSignatureSize() {
+size_t GetSignatureSize(const string& private_key_path) {
   const vector<char> data(1, 'x');
   vector<char> hash;
   EXPECT_TRUE(OmahaHashCalculator::RawHashOfData(data, &hash));
   vector<char> signature;
   EXPECT_TRUE(PayloadSigner::SignHash(hash,
-                                      kUnittestPrivateKeyPath,
+                                      private_key_path,
                                       &signature));
   return signature.size();
 }
 
 void SignGeneratedPayload(const string& payload_path) {
-  int signature_size = GetSignatureSize();
+  int signature_size = GetSignatureSize(kUnittestPrivateKeyPath);
   vector<char> hash;
   ASSERT_TRUE(PayloadSigner::HashPayloadForSigning(payload_path,
                                                    signature_size,
@@ -130,12 +131,31 @@
                                                  kUnittestPublicKeyPath));
 }
 
-void SignGeneratedShellPayload(const string& payload_path) {
-  int signature_size = GetSignatureSize();
+void SignGeneratedShellPayload(SignatureTest signature_test,
+                               const string& payload_path) {
+  string private_key_path = kUnittestPrivateKeyPath;
+  if (signature_test == kSignatureGeneratedShellBadKey) {
+    ASSERT_TRUE(utils::MakeTempFile("/tmp/key.XXXXXX",
+                                    &private_key_path,
+                                    NULL));
+  } else {
+    ASSERT_EQ(kSignatureGeneratedShell, signature_test);
+  }
+  ScopedPathUnlinker key_unlinker(private_key_path);
+  key_unlinker.set_should_remove(signature_test ==
+                                 kSignatureGeneratedShellBadKey);
+  // Generates a new private key that will not match the public key.
+  if (signature_test == kSignatureGeneratedShellBadKey) {
+    LOG(INFO) << "Generating a mismatched private key.";
+    ASSERT_EQ(0,
+              System(StringPrintf(
+                  "/usr/bin/openssl genrsa -out %s 1024",
+                  private_key_path.c_str())));
+  }
+  int signature_size = GetSignatureSize(private_key_path);
   string hash_file;
   ASSERT_TRUE(utils::MakeTempFile("/tmp/hash.XXXXXX", &hash_file, NULL));
   ScopedPathUnlinker hash_unlinker(hash_file);
-
   ASSERT_EQ(0,
             System(StringPrintf(
                 "./delta_generator -in_file %s -signature_size %d "
@@ -150,7 +170,7 @@
   ASSERT_EQ(0,
             System(StringPrintf(
                 "/usr/bin/openssl rsautl -pkcs -sign -inkey %s -in %s -out %s",
-                kUnittestPrivateKeyPath,
+                private_key_path.c_str(),
                 hash_file.c_str(),
                 sig_file.c_str())));
   ASSERT_EQ(0,
@@ -160,11 +180,15 @@
                 payload_path.c_str(),
                 sig_file.c_str(),
                 payload_path.c_str())));
-  ASSERT_EQ(0,
-            System(StringPrintf(
-                "./delta_generator -in_file %s -public_key %s",
-                payload_path.c_str(),
-                kUnittestPublicKeyPath)));
+  int verify_result =
+      System(StringPrintf("./delta_generator -in_file %s -public_key %s",
+                          payload_path.c_str(),
+                          kUnittestPublicKeyPath));
+  if (signature_test == kSignatureGeneratedShellBadKey) {
+    ASSERT_NE(0, verify_result);
+  } else {
+    ASSERT_EQ(0, verify_result);
+  }
 }
 
 void DoSmallImageTest(bool full_kernel, bool full_rootfs, bool noop,
@@ -289,8 +313,9 @@
 
   if (signature_test == kSignatureGenerated) {
     SignGeneratedPayload(delta_path);
-  } else if (signature_test == kSignatureGeneratedShell) {
-    SignGeneratedShellPayload(delta_path);
+  } else if (signature_test == kSignatureGeneratedShell ||
+             signature_test == kSignatureGeneratedShellBadKey) {
+    SignGeneratedShellPayload(signature_test, delta_path);
   }
 
   // Read delta into memory.
@@ -412,11 +437,18 @@
                        strlen(new_data_string)));
 
   EXPECT_TRUE(utils::FileExists(kUnittestPublicKeyPath));
-  EXPECT_EQ(signature_test != kSignatureNone,
+  bool expect_verify_success =
+      signature_test != kSignatureNone &&
+      signature_test != kSignatureGeneratedShellBadKey;
+  EXPECT_EQ(expect_verify_success,
             performer.VerifyPayload(
                 kUnittestPublicKeyPath,
                 OmahaHashCalculator::OmahaHashOfData(delta),
                 delta.size()));
+  EXPECT_TRUE(performer.VerifyPayload(
+      "/public/key/does/not/exists",
+      OmahaHashCalculator::OmahaHashOfData(delta),
+      delta.size()));
 
   uint64_t new_kernel_size;
   vector<char> new_kernel_hash;
@@ -469,6 +501,10 @@
   DoSmallImageTest(false, false, false, kSignatureGeneratedShell);
 }
 
+TEST(DeltaPerformerTest, RunAsRootSmallImageSignGeneratedShellBadKeyTest) {
+  DoSmallImageTest(false, false, false, kSignatureGeneratedShellBadKey);
+}
+
 TEST(DeltaPerformerTest, BadDeltaMagicTest) {
   PrefsMock prefs;
   DeltaPerformer performer(&prefs);
diff --git a/utils.h b/utils.h
index 86ccfb7..74711a8 100644
--- a/utils.h
+++ b/utils.h
@@ -294,15 +294,20 @@
 // Utility class to delete a file when it goes out of scope.
 class ScopedPathUnlinker {
  public:
-  explicit ScopedPathUnlinker(const std::string& path) : path_(path) {}
+  explicit ScopedPathUnlinker(const std::string& path)
+      : path_(path),
+        should_remove_(true) {}
   ~ScopedPathUnlinker() {
-    if (unlink(path_.c_str()) < 0) {
+    if (should_remove_ && unlink(path_.c_str()) < 0) {
       std::string err_message = strerror(errno);
       LOG(ERROR) << "Unable to unlink path " << path_ << ": " << err_message;
     }
   }
+  void set_should_remove(bool should_remove) { should_remove_ = should_remove; }
+
  private:
   const std::string path_;
+  bool should_remove_;
   DISALLOW_COPY_AND_ASSIGN(ScopedPathUnlinker);
 };