diff --git a/tuf/signed/errors.go b/tuf/signed/errors.go
index 2c5174bef9..1591ae4f2b 100644
--- a/tuf/signed/errors.go
+++ b/tuf/signed/errors.go
@@ -51,6 +51,13 @@ func (e ErrInvalidKeyType) Error() string {
 	return "key type is not valid for signature"
 }
 
+// ErrInvalidKeyID indicates the specified key ID was incorrect for its associated data
+type ErrInvalidKeyID struct{}
+
+func (e ErrInvalidKeyID) Error() string {
+	return "key ID is not valid for key content"
+}
+
 // ErrInvalidKeyLength indicates that while we may support the cipher, the provided
 // key length is not specifically supported, i.e. we support RSA, but not 1024 bit keys
 type ErrInvalidKeyLength struct {
diff --git a/tuf/signed/verify.go b/tuf/signed/verify.go
index 7e34e2599f..0805bba65a 100644
--- a/tuf/signed/verify.go
+++ b/tuf/signed/verify.go
@@ -125,6 +125,10 @@ func VerifySignatures(s *data.Signed, roleData data.BaseRole) error {
 			logrus.Debugf("continuing b/c keyid lookup was nil: %s\n", sig.KeyID)
 			continue
 		}
+		// Check that the signature key ID actually matches the content ID of the key
+		if key.ID() != sig.KeyID {
+			return ErrInvalidKeyType{}
+		}
 		if err := VerifySignature(msg, sig, key); err != nil {
 			logrus.Debugf("continuing b/c %s", err.Error())
 			continue