diff --git a/scripts/install.joinmarket.sh b/scripts/install.joinmarket.sh
index 6be93d8..a54e35f 100755
--- a/scripts/install.joinmarket.sh
+++ b/scripts/install.joinmarket.sh
@@ -2,19 +2,20 @@
 
 # https://github.com/JoinMarket-Org/joinmarket-clientserver/releases
 # Use tag for verification when available, otherwise use commit hash
-# testedJMversion="v0.9.11"
+testedJMversion="v0.9.12"
 
 # https://github.com/JoinMarket-Org/joinmarket-clientserver/commits/master/
 # Only used if testedJMversion is empty or not set
-testedJMcommit="ce32bafbb5d716bde61830f71266410249d43dbc"
+#testedJMcommit="ce32bafbb5d716bde61830f71266410249d43dbc"
 
-PGPsigner="kristapsk"
-PGPpkeys="https://github.com/kristapsk.gpg"
-PGPcheck="33E472FE870C7E5D"
+PGPsigner="AdamISZ"
+PGPpkeys="https://github.com/AdamISZ.gpg"
+# AdamISZ current primary code-signing key used for v0.9.12
+PGPcheck="0F1C7345D9193D1C8E3F21810C44134F93234873"
 
-#PGPsigner="waxwing"
-#PGPpkeys="https://raw.githubusercontent.com/JoinMarket-Org/joinmarket-clientserver/master/pubkeys/AdamGibson.asc"
-#PGPcheck="2B6FC204D9BF332D062B461A141001A1AF77F20B"
+#PGPsigner="kristapsk"
+#PGPpkeys="https://github.com/kristapsk.gpg"
+#PGPcheck="33E472FE870C7E5D"
 
 me="${0##/*}"
 
diff --git a/scripts/verify.git.sh b/scripts/verify.git.sh
index 89ded16..6360073 100644
--- a/scripts/verify.git.sh
+++ b/scripts/verify.git.sh
@@ -30,9 +30,18 @@ PGPsigner="$1"
 PGPpubkeyLink="$2"
 PGPpubkeyFingerprint="$3"
 
-wget --prefer-family=ipv4 -O /dev/shm/pgp_keys_${PGPsigner}.asc "${PGPpubkeyLink}"
-gpg --import --import-options show-only /dev/shm/pgp_keys_${PGPsigner}.asc
-fingerprint=$(gpg --show-keys /dev/shm/pgp_keys_${PGPsigner}.asc 2>/dev/null | grep "${PGPpubkeyFingerprint}" -c)
+_temp_dir="$(mktemp -d -p /dev/shm/ 2>/dev/null || mktemp -d)"
+trap 'rm -rf "$_temp_dir"' EXIT
+
+keyFile="${_temp_dir}/pgp_keys_${PGPsigner}.asc"
+rawKeyFile="${keyFile}.raw"
+
+wget --prefer-family=ipv4 -O "${rawKeyFile}" "${PGPpubkeyLink}"
+# GitHub can add a Note: armor header when an account key cannot be exported.
+# GPG imports the key anyway, but prints a misleading "unknown armor header".
+grep -v '^Note: ' "${rawKeyFile}" >"${keyFile}"
+gpg --quiet --import --import-options show-only "${keyFile}"
+fingerprint=$(gpg --show-keys --with-subkey-fingerprint "${keyFile}" 2>/dev/null | tr -d " \t\n\r" | grep "${PGPpubkeyFingerprint}" -c)
 if [ "${fingerprint}" -lt 1 ]; then
   echo
   echo "# WARNING --> the PGP fingerprint is not as expected for ${PGPsigner}" >&2
@@ -40,11 +49,9 @@ if [ "${fingerprint}" -lt 1 ]; then
   echo "# Exiting" >&2
   exit 7
 fi
-gpg --import /dev/shm/pgp_keys_${PGPsigner}.asc
-rm /dev/shm/pgp_keys_${PGPsigner}.asc
+gpg --quiet --import "${keyFile}"
 
-trap 'rm -f "$_temp"' EXIT
-_temp="$(mktemp -p /dev/shm/)"
+_temp="${_temp_dir}/git-verify.out"
 
 if [ $# -eq 3 ] || [ -z "$4" ]; then
   commitHash="$(git log --oneline | head -1 | awk '{print $1}')"