diff --git a/host/src/cred/keys.rs b/host/src/cred/keys.rs
index b19d814..78dee7e 100644
--- a/host/src/cred/keys.rs
+++ b/host/src/cred/keys.rs
@@ -141,7 +141,7 @@ pub(super) fn read(value: &str, format: &str, passphrase: Option<&str>) -> Resul
             "ed25519" => Key::Ed(SigningKey::from_bytes(
                 bytes.as_slice().try_into().map_err(|_| invalid_key())?,
             )),
-            "es256" => {
+            "es256" if bytes.len() == 32 => {
                 Key::Ec(p256::ecdsa::SigningKey::from_slice(&bytes).map_err(|_| invalid_key())?)
             }
             "hmac" => Key::Mac(bytes),