diff --git a/certs/certs_test.go b/certs/certs_test.go
index 4ea992308c..11ea31c816 100644
--- a/certs/certs_test.go
+++ b/certs/certs_test.go
@@ -291,7 +291,7 @@ func testValidateSuccessfulRootRotation(t *testing.T, keyAlg, rootKeyType string
 	signedTestRoot, err := testRoot.ToSigned()
 	require.NoError(t, err)
 
-	err = signed.Sign(cs, signedTestRoot, replRootKey, origRootKey)
+	err = signed.Sign(cs, signedTestRoot, []data.PublicKey{replRootKey, origRootKey})
 	require.NoError(t, err)
 
 	// This call to ValidateRoot will succeed since we are using a valid PEM
@@ -352,7 +352,7 @@ func testValidateRootRotationMissingOrigSig(t *testing.T, keyAlg, rootKeyType st
 	require.NoError(t, err)
 
 	// We only sign with the new key, and not with the original one.
-	err = signed.Sign(cryptoService, signedTestRoot, replRootKey)
+	err = signed.Sign(cryptoService, signedTestRoot, []data.PublicKey{replRootKey})
 	require.NoError(t, err)
 
 	// This call to ValidateRoot will succeed since we are using a valid PEM
@@ -416,7 +416,7 @@ func testValidateRootRotationMissingNewSig(t *testing.T, keyAlg, rootKeyType str
 	require.NoError(t, err)
 
 	// We only sign with the old key, and not with the new one
-	err = signed.Sign(cryptoService, signedTestRoot, origRootKey)
+	err = signed.Sign(cryptoService, signedTestRoot, []data.PublicKey{origRootKey})
 	require.NoError(t, err)
 
 	// This call to ValidateRoot will succeed since we are using a valid PEM
diff --git a/server/handlers/validation_test.go b/server/handlers/validation_test.go
index 8bcb1d75da..9e7cbfe0a8 100644
--- a/server/handlers/validation_test.go
+++ b/server/handlers/validation_test.go
@@ -387,7 +387,7 @@ func TestValidateRootRotation(t *testing.T) {
 
 	r, err = repo.SignRoot(data.DefaultExpires(data.CanonicalRootRole))
 	require.NoError(t, err)
-	err = signed.Sign(crypto, r, rootKey, oldRootKey)
+	err = signed.Sign(crypto, r, []data.PublicKey{rootKey, oldRootKey})
 	require.NoError(t, err)
 
 	rt, err := data.RootFromSigned(r)
@@ -430,7 +430,7 @@ func TestRootRotationNotSignedWithOldKeys(t *testing.T) {
 
 	r, err = repo.SignRoot(data.DefaultExpires(data.CanonicalRootRole))
 	require.NoError(t, err)
-	err = signed.Sign(crypto, r, rootKey)
+	err = signed.Sign(crypto, r, []data.PublicKey{rootKey})
 	require.NoError(t, err)
 
 	rt, err := data.RootFromSigned(r)
diff --git a/tuf/client/client_test.go b/tuf/client/client_test.go
index 12a08be328..c33c897bfb 100644
--- a/tuf/client/client_test.go
+++ b/tuf/client/client_test.go
@@ -60,7 +60,7 @@ func TestRotation(t *testing.T) {
 
 	// Sign testRoot with both old and new keys
 	signedRoot, err := testRoot.ToSigned()
-	err = signed.Sign(signer, signedRoot, rootKey, replacementKey)
+	err = signed.Sign(signer, signedRoot, []data.PublicKey{rootKey, replacementKey})
 	require.NoError(t, err, "Failed to sign root")
 	var origKeySig bool
 	var replKeySig bool
@@ -122,7 +122,7 @@ func TestRotationNewSigMissing(t *testing.T) {
 
 	// Sign testRoot with both old and new keys
 	signedRoot, err := testRoot.ToSigned()
-	err = signed.Sign(signer, signedRoot, rootKey)
+	err = signed.Sign(signer, signedRoot, []data.PublicKey{rootKey})
 	require.NoError(t, err, "Failed to sign root")
 	var origKeySig bool
 	var replKeySig bool
@@ -185,7 +185,7 @@ func TestRotationOldSigMissing(t *testing.T) {
 
 	// Sign testRoot with both old and new keys
 	signedRoot, err := testRoot.ToSigned()
-	err = signed.Sign(signer, signedRoot, replacementKey)
+	err = signed.Sign(signer, signedRoot, []data.PublicKey{replacementKey})
 	require.NoError(t, err, "Failed to sign root")
 	var origKeySig bool
 	var replKeySig bool
diff --git a/tuf/signed/sign.go b/tuf/signed/sign.go
index 52e716e03a..de9e3077eb 100644
--- a/tuf/signed/sign.go
+++ b/tuf/signed/sign.go
@@ -20,11 +20,11 @@ import (
 	"github.com/docker/notary/tuf/utils"
 )
 
-// Sign takes a data.Signed and a key, calculated and adds the signature
+// Sign takes a data.Signed and keys, calculates and adds the signature
 // to the data.Signed
 // N.B. All public keys for a role should be passed so that this function
 //      can correctly clean up signatures that are no longer valid.
-func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error {
+func Sign(service CryptoService, s *data.Signed, keys []data.PublicKey) error {
 	logrus.Debugf("sign called with %d keys", len(keys))
 	signatures := make([]data.Signature, 0, len(s.Signatures)+1)
 	signingKeyIDs := make(map[string]struct{})
diff --git a/tuf/signed/sign_test.go b/tuf/signed/sign_test.go
index b02338db55..670c49bc1c 100644
--- a/tuf/signed/sign_test.go
+++ b/tuf/signed/sign_test.go
@@ -101,7 +101,7 @@ func TestBasicSign(t *testing.T) {
 		Signed: &json.RawMessage{},
 	}
 
-	err = Sign(cs, &testData, key)
+	err = Sign(cs, &testData, []data.PublicKey{key})
 	require.NoError(t, err)
 
 	if len(testData.Signatures) != 1 {
@@ -123,8 +123,8 @@ func TestReSign(t *testing.T) {
 		Signed: &json.RawMessage{},
 	}
 
-	Sign(cs, &testData, key)
-	Sign(cs, &testData, key)
+	Sign(cs, &testData, []data.PublicKey{key})
+	Sign(cs, &testData, []data.PublicKey{key})
 
 	if len(testData.Signatures) != 1 {
 		t.Fatalf("Incorrect number of signatures: %d", len(testData.Signatures))
@@ -146,7 +146,7 @@ func TestMultiSign(t *testing.T) {
 	key1, err := cs.Create(data.CanonicalRootRole, "", data.ED25519Key)
 	require.NoError(t, err)
 
-	Sign(cs, &testData, key1)
+	Sign(cs, &testData, []data.PublicKey{key1})
 
 	// reinitializing cs means it won't know about key1. We want
 	// to attempt to sign passing both key1 and key2, while expecting
@@ -159,8 +159,7 @@ func TestMultiSign(t *testing.T) {
 	Sign(
 		cs,
 		&testData,
-		key1,
-		key2,
+		[]data.PublicKey{key1, key2},
 	)
 
 	if len(testData.Signatures) != 2 {
@@ -186,7 +185,7 @@ func TestSignReturnsNoSigs(t *testing.T) {
 
 	testKey, _ := pem.Decode([]byte(testKeyPEM1))
 	key := data.NewPublicKey(data.RSAKey, testKey.Bytes)
-	err := Sign(failingCryptoService, &testData, key)
+	err := Sign(failingCryptoService, &testData, []data.PublicKey{key})
 
 	if err == nil {
 		t.Fatalf("Expected failure due to no signature being returned by the crypto service")
@@ -214,7 +213,7 @@ func TestSignWithX509(t *testing.T) {
 	testData := data.Signed{
 		Signed: &json.RawMessage{},
 	}
-	err = Sign(mockCryptoService, &testData, tufRSAx509Key)
+	err = Sign(mockCryptoService, &testData, []data.PublicKey{tufRSAx509Key})
 	require.NoError(t, err)
 
 	require.Len(t, testData.Signatures, 1)
@@ -230,7 +229,7 @@ func TestSignRemovesValidSigByInvalidKey(t *testing.T) {
 	key1, err := cs.Create(data.CanonicalRootRole, "", data.ED25519Key)
 	require.NoError(t, err)
 
-	Sign(cs, &testData, key1)
+	Sign(cs, &testData, []data.PublicKey{key1})
 	require.Len(t, testData.Signatures, 1)
 	require.Equal(t, key1.ID(), testData.Signatures[0].KeyID)
 
@@ -239,11 +238,7 @@ func TestSignRemovesValidSigByInvalidKey(t *testing.T) {
 
 	// should remove key1 sig even though it's valid. It no longer appears
 	// in the list of signing keys for the role
-	Sign(
-		cs,
-		&testData,
-		key2,
-	)
+	Sign(cs, &testData, []data.PublicKey{key2})
 
 	require.Len(t, testData.Signatures, 1)
 	require.Equal(t, key2.ID(), testData.Signatures[0].KeyID)
@@ -258,7 +253,7 @@ func TestSignRemovesInvalidSig(t *testing.T) {
 	key1, err := cs.Create(data.CanonicalRootRole, "", data.ED25519Key)
 	require.NoError(t, err)
 
-	Sign(cs, &testData, key1)
+	Sign(cs, &testData, []data.PublicKey{key1})
 	require.Len(t, testData.Signatures, 1)
 	require.Equal(t, key1.ID(), testData.Signatures[0].KeyID)
 
@@ -271,12 +266,7 @@ func TestSignRemovesInvalidSig(t *testing.T) {
 	raw := json.RawMessage([]byte{0xff})
 	testData.Signed = &raw
 	// should remove key1 sig because it's out of date
-	Sign(
-		cs,
-		&testData,
-		key1,
-		key2,
-	)
+	Sign(cs, &testData, []data.PublicKey{key1, key2})
 
 	require.Len(t, testData.Signatures, 1)
 	require.Equal(t, key2.ID(), testData.Signatures[0].KeyID)
diff --git a/tuf/signed/verify_test.go b/tuf/signed/verify_test.go
index 83d8f04258..f055e16117 100644
--- a/tuf/signed/verify_test.go
+++ b/tuf/signed/verify_test.go
@@ -23,7 +23,7 @@ func TestRoleNoKeys(t *testing.T) {
 	b, err := json.MarshalCanonical(meta)
 	require.NoError(t, err)
 	s := &data.Signed{Signed: (*json.RawMessage)(&b)}
-	Sign(cs, s, k)
+	Sign(cs, s, []data.PublicKey{k})
 	err = Verify(s, roleWithKeys, 1)
 	require.IsType(t, ErrRoleThreshold{}, err)
 }
@@ -40,7 +40,7 @@ func TestNotEnoughSigs(t *testing.T) {
 	b, err := json.MarshalCanonical(meta)
 	require.NoError(t, err)
 	s := &data.Signed{Signed: (*json.RawMessage)(&b)}
-	Sign(cs, s, k)
+	Sign(cs, s, []data.PublicKey{k})
 	err = Verify(s, roleWithKeys, 1)
 	require.IsType(t, ErrRoleThreshold{}, err)
 }
@@ -58,7 +58,7 @@ func TestMoreThanEnoughSigs(t *testing.T) {
 	b, err := json.MarshalCanonical(meta)
 	require.NoError(t, err)
 	s := &data.Signed{Signed: (*json.RawMessage)(&b)}
-	Sign(cs, s, k1, k2)
+	Sign(cs, s, []data.PublicKey{k1, k2})
 	require.Equal(t, 2, len(s.Signatures))
 	err = Verify(s, roleWithKeys, 1)
 	require.NoError(t, err)
@@ -75,7 +75,7 @@ func TestValidSigWithIncorrectKeyID(t *testing.T) {
 	b, err := json.MarshalCanonical(meta)
 	require.NoError(t, err)
 	s := &data.Signed{Signed: (*json.RawMessage)(&b)}
-	Sign(cs, s, k1)
+	Sign(cs, s, []data.PublicKey{k1})
 	require.Equal(t, 1, len(s.Signatures))
 	s.Signatures[0].KeyID = "invalidIDA"
 	err = Verify(s, roleWithKeys, 1)
@@ -94,7 +94,7 @@ func TestDuplicateSigs(t *testing.T) {
 	b, err := json.MarshalCanonical(meta)
 	require.NoError(t, err)
 	s := &data.Signed{Signed: (*json.RawMessage)(&b)}
-	Sign(cs, s, k)
+	Sign(cs, s, []data.PublicKey{k})
 	s.Signatures = append(s.Signatures, s.Signatures[0])
 	err = Verify(s, roleWithKeys, 1)
 	require.IsType(t, ErrRoleThreshold{}, err)
@@ -113,7 +113,7 @@ func TestUnknownKeyBelowThreshold(t *testing.T) {
 	b, err := json.MarshalCanonical(meta)
 	require.NoError(t, err)
 	s := &data.Signed{Signed: (*json.RawMessage)(&b)}
-	Sign(cs, s, k, unknown)
+	Sign(cs, s, []data.PublicKey{k, unknown})
 	s.Signatures = append(s.Signatures)
 	err = Verify(s, roleWithKeys, 1)
 	require.IsType(t, ErrRoleThreshold{}, err)
@@ -188,7 +188,7 @@ func Test(t *testing.T) {
 			b, err := json.MarshalCanonical(meta)
 			require.NoError(t, err)
 			s := &data.Signed{Signed: (*json.RawMessage)(&b)}
-			Sign(cryptoService, s, k)
+			Sign(cryptoService, s, []data.PublicKey{k})
 			run.s = s
 		}
 		if run.mut != nil {
diff --git a/tuf/testutils/swizzler.go b/tuf/testutils/swizzler.go
index ad1a115c43..a3a8e6d4ee 100644
--- a/tuf/testutils/swizzler.go
+++ b/tuf/testutils/swizzler.go
@@ -72,7 +72,7 @@ func serializeMetadata(cs signed.CryptoService, s *data.Signed, role string,
 		return nil, ErrNoKeyForRole{role}
 	}
 
-	if err := signed.Sign(cs, s, pubKeys...); err != nil {
+	if err := signed.Sign(cs, s, pubKeys); err != nil {
 		if _, ok := err.(signed.ErrNoKeys); ok {
 			return nil, ErrNoKeyForRole{Role: role}
 		}
diff --git a/tuf/tuf.go b/tuf/tuf.go
index 0ebad2a9f6..ed62624115 100644
--- a/tuf/tuf.go
+++ b/tuf/tuf.go
@@ -919,7 +919,7 @@ func (tr *Repo) SignTimestamp(expires time.Time) (*data.Signed, error) {
 }
 
 func (tr Repo) sign(signedData *data.Signed, role data.BaseRole) (*data.Signed, error) {
-	if err := signed.Sign(tr.cryptoService, signedData, role.ListKeys()...); err != nil {
+	if err := signed.Sign(tr.cryptoService, signedData, role.ListKeys()); err != nil {
 		return nil, err
 	}
 	return signedData, nil