diff --git a/arch_install.sh b/arch_install.sh
index 8350a1a..125c6a2 100644
--- a/arch_install.sh
+++ b/arch_install.sh
@@ -9,6 +9,7 @@
 #   - installs and enables OpenSSH
 #   - installs and safely configures UFW
 #   - creates an admin UNIX account
+#   - imports the required GPG key for openssl-1.1
 #   - installs AUR dependencies for RStudio Server
 #   - installs R and RStudio Server
 #   - installs JupyterHub into /opt/jupyterhub
@@ -36,6 +37,11 @@ JUPYTERHUB_CONFIG_FILE="${JUPYTERHUB_CONFIG_DIR}/jupyterhub_config.py"
 JUPYTERHUB_SERVICE_FILE="/etc/systemd/system/jupyterhub.service"
 
 USE_UFW="yes"
+
+# Required for openssl-1.1 AUR signature verification
+OPENSSL11_GPG_KEY="D894E2CE8B3D79F5"
+OPENSSL11_GPG_KEYSERVER_PRIMARY="hkps://keyserver.ubuntu.com"
+OPENSSL11_GPG_KEYSERVER_FALLBACK="hkps://keys.openpgp.org"
 # -----------------------------
 
 log() {
@@ -100,6 +106,7 @@ install_base_packages() {
     shadow \
     which \
     iproute2 \
+    gnupg \
     r \
     gcc-fortran \
     openssl
@@ -118,7 +125,6 @@ configure_firewall() {
 
   log "Configuring UFW firewall safely"
 
-  # Allow SSH first so remote access is not lost
   ufw allow "${SSH_PORT}"/tcp
   ufw allow 80/tcp
   ufw allow 443/tcp
@@ -144,6 +150,23 @@ create_admin_user() {
   fi
 }
 
+ensure_gpg_key() {
+  local key_id="$1"
+
+  log "Ensuring GPG key is present: ${key_id}"
+
+  sudo -u "${REAL_USER}" bash -lc "
+    set -Eeuo pipefail
+
+    if gpg --list-keys '${key_id}' >/dev/null 2>&1; then
+      exit 0
+    fi
+
+    gpg --keyserver '${OPENSSL11_GPG_KEYSERVER_PRIMARY}' --recv-keys '${key_id}' || \
+    gpg --keyserver '${OPENSSL11_GPG_KEYSERVER_FALLBACK}' --recv-keys '${key_id}'
+  "
+}
+
 install_aur_package() {
   local pkg_name="$1"
   local build_dir="${REAL_HOME}/${pkg_name}-build"
@@ -166,7 +189,7 @@ install_aur_package() {
 install_rstudio_server() {
   log "Installing RStudio Server from AUR"
 
-  # rstudio-server-bin depends on openssl-1.1, which must be installed first
+  ensure_gpg_key "${OPENSSL11_GPG_KEY}"
   install_aur_package "openssl-1.1"
   install_aur_package "rstudio-server-bin"
 
@@ -178,7 +201,6 @@ install_rstudio_server() {
     sed -i 's|^rsession-which-r=.*|rsession-which-r=/usr/bin/R|' /etc/rstudio/rserver.conf
   fi
 
-  # Remove broken/undesired server-user entries if present
   sed -i '/^server-user=/d' /etc/rstudio/rserver.conf 2>/dev/null || true
 
   mkdir -p /var/lib/rstudio-server
@@ -238,7 +260,6 @@ c.JupyterHub.db_url = 'sqlite:///${JUPYTERHUB_CONFIG_DIR}/jupyterhub.sqlite'
 c.ConfigurableHTTPProxy.command = 'configurable-http-proxy'
 EOF
 
-  # JupyterHub expects a valid text/hex secret here, not raw binary
   python - <<'PY'
 import os
 import secrets