diff --git a/doc/mkimage.1 b/doc/mkimage.1
index 878db904757..759dc2d12f5 100644
--- a/doc/mkimage.1
+++ b/doc/mkimage.1
@@ -218,6 +218,13 @@ CONFIG_OF_CONTROL in U-Boot.
 Specifies the private key file to use when signing. This option may be used
 instead of \-k.
 
+.TP
+.BI "\-g [" "key_name_hint" "]"
+Sets the key-name-hint property when used with \-f auto. This is the <name>
+part of the key. The directory part is set by \-k. This option also indicates
+that the images included in the FIT should be signed. If this option is
+specified, \-o must be specified as well.
+
 .TP
 .BI "\-o [" "signing algorithm" "]"
 Specifies the algorithm to be used for signing a FIT image. The default is
@@ -278,6 +285,15 @@ skipping those for which keys cannot be found. Also add a comment.
 .B -c """Kernel 3.8 image for production devices""" kernel.itb
 .fi
 
+.P
+Add public keys to u-boot.dtb without needing a FIT to sign. This will also
+create a FIT containing an images node with no data named unused.itb.
+.nf
+.B mkimage -f auto -d /dev/null -k /public/signing-keys -g dev \\\\
+.br
+.B -o sha256,rsa2048 -K u-boot.dtb unused.itb
+.fi
+
 .P
 Update an existing FIT image, signing it with additional keys.
 Add corresponding public keys into u-boot.dtb. This will resign all images
@@ -306,6 +322,14 @@ automatic mode. No .its file is required.
 .B -c """Kernel 4.4 image for production devices""" -d vmlinuz \\\\
 .B -b /path/to/rk3288-firefly.dtb -b /path/to/rk3288-jerry.dtb kernel.itb
 .fi
+.P
+Create a FIT image containing a signed kernel, using automatic mode. No .its
+file is required.
+.nf
+.B mkimage -f auto -A arm -O linux -T kernel -C none -a 43e00000 -e 0 \\\\
+.br
+.B -d vmlinuz -k /secret/signing-keys -g dev -o sha256,rsa2048 kernel.itb
+.fi
 
 .SH HOMEPAGE
 http://www.denx.de/wiki/U-Boot/WebHome
diff --git a/tools/fit_image.c b/tools/fit_image.c
index 1884a2eb0b9..979f2411ee0 100644
--- a/tools/fit_image.c
+++ b/tools/fit_image.c
@@ -199,15 +199,36 @@ static void get_basename(char *str, int size, const char *fname)
 }
 
 /**
- * add_crc_node() - Add a hash node to request a CRC checksum for an image
+ * add_hash_node() - Add a hash or signature node
  *
+ * @params: Image parameters
  * @fdt: Device tree to add to (in sequential-write mode)
+ *
+ * If there is a key name hint, try to sign the images. Otherwise, just add a
+ * CRC.
+ *
+ * Return: 0 on success, or -1 on failure
  */
-static void add_crc_node(void *fdt)
+static int add_hash_node(struct image_tool_params *params, void *fdt)
 {
-	fdt_begin_node(fdt, "hash-1");
-	fdt_property_string(fdt, FIT_ALGO_PROP, "crc32");
+	if (params->keyname) {
+		if (!params->algo_name) {
+			fprintf(stderr,
+				"%s: Algorithm name must be specified\n",
+				params->cmdname);
+			return -1;
+		}
+
+		fdt_begin_node(fdt, "signature-1");
+		fdt_property_string(fdt, FIT_ALGO_PROP, params->algo_name);
+		fdt_property_string(fdt, FIT_KEY_HINT, params->keyname);
+	} else {
+		fdt_begin_node(fdt, "hash-1");
+		fdt_property_string(fdt, FIT_ALGO_PROP, "crc32");
+	}
+
 	fdt_end_node(fdt);
+	return 0;
 }
 
 /**
@@ -248,7 +269,9 @@ static int fit_write_images(struct image_tool_params *params, char *fdt)
 	ret = fdt_property_file(params, fdt, FIT_DATA_PROP, params->datafile);
 	if (ret)
 		return ret;
-	add_crc_node(fdt);
+	ret = add_hash_node(params, fdt);
+	if (ret)
+		return ret;
 	fdt_end_node(fdt);
 
 	/* Now the device tree files if available */
@@ -271,7 +294,9 @@ static int fit_write_images(struct image_tool_params *params, char *fdt)
 				    genimg_get_arch_short_name(params->arch));
 		fdt_property_string(fdt, FIT_COMP_PROP,
 				    genimg_get_comp_short_name(IH_COMP_NONE));
-		add_crc_node(fdt);
+		ret = add_hash_node(params, fdt);
+		if (ret)
+			return ret;
 		fdt_end_node(fdt);
 	}
 
@@ -289,7 +314,9 @@ static int fit_write_images(struct image_tool_params *params, char *fdt)
 					params->fit_ramdisk);
 		if (ret)
 			return ret;
-		add_crc_node(fdt);
+		ret = add_hash_node(params, fdt);
+		if (ret)
+			return ret;
 		fdt_end_node(fdt);
 	}
 
diff --git a/tools/imagetool.h b/tools/imagetool.h
index 05dd94d1084..ca7c2e48ba9 100644
--- a/tools/imagetool.h
+++ b/tools/imagetool.h
@@ -71,6 +71,7 @@ struct image_tool_params {
 	const char *keydir;	/* Directory holding private keys */
 	const char *keydest;	/* Destination .dtb for public key */
 	const char *keyfile;	/* Filename of private or public key */
+	const char *keyname;	/* Key name "hint" */
 	const char *comment;	/* Comment to add to signature node */
 	/* Algorithm name to use for hashing/signing or NULL to use the one
 	 * specified in the its */
diff --git a/tools/mkimage.c b/tools/mkimage.c
index 5c6a60e8513..0e1198b4113 100644
--- a/tools/mkimage.c
+++ b/tools/mkimage.c
@@ -119,6 +119,7 @@ static void usage(const char *msg)
 		"Signing / verified boot options: [-k keydir] [-K dtb] [ -c <comment>] [-p addr] [-r] [-N engine]\n"
 		"          -k => set directory containing private keys\n"
 		"          -K => write public keys to this .dtb file\n"
+		"          -g => set key name hint\n"
 		"          -G => use this signing key (in lieu of -k)\n"
 		"          -c => add comment in signature node\n"
 		"          -F => re-sign existing FIT image\n"
@@ -163,7 +164,7 @@ static void process_args(int argc, char **argv)
 	int opt;
 
 	while ((opt = getopt(argc, argv,
-		   "a:A:b:B:c:C:d:D:e:Ef:FG:k:i:K:ln:N:p:o:O:rR:qstT:vVx")) != -1) {
+		   "a:A:b:B:c:C:d:D:e:Ef:Fg:G:k:i:K:ln:N:p:o:O:rR:qstT:vVx")) != -1) {
 		switch (opt) {
 		case 'a':
 			params.addr = strtoull(optarg, &ptr, 16);
@@ -239,6 +240,8 @@ static void process_args(int argc, char **argv)
 			params.type = IH_TYPE_FLATDT;
 			params.fflag = 1;
 			break;
+		case 'g':
+			params.keyname = optarg;
 		case 'G':
 			params.keyfile = optarg;
 			break;