diff --git a/git-flow-hotfix b/git-flow-hotfix
index 7ffa39b..9b9974e 100644
--- a/git-flow-hotfix
+++ b/git-flow-hotfix
@@ -113,7 +113,7 @@
 }
 
 cmd_start() {
-	DEFINE_boolean fetch true "fetch from $ORIGIN before finishing hotfix" F
+	DEFINE_boolean fetch true "fetch from $ORIGIN before performing finish" F
 	parse_args "$@"
 	BASE="${2:-$MASTER_BRANCH}"
 	require_version_arg
@@ -121,11 +121,12 @@
 
 	# sanity checks
 	gitflow_require_clean_working_tree
+	gitflow_require_branch_absent $BRANCH
+	gitflow_require_tag_absent $VERSION_PREFIX$VERSION
 	if flag fetch; then
 		git fetch -q $ORIGIN $MASTER_BRANCH
 	fi
 	gitflow_require_branches_equal $MASTER_BRANCH $ORIGIN/$MASTER_BRANCH
-	gitflow_require_branch_absent $BRANCH
 
 	# create branch
 	git checkout -b $BRANCH $BASE
@@ -145,27 +146,46 @@
 }
 
 cmd_finish() {
-	DEFINE_boolean fetch true "fetch from $ORIGIN before finishing hotfix" F
+	DEFINE_boolean fetch true "fetch from $ORIGIN before performing finish" F
+	DEFINE_boolean sign false "sign the release tag cryptographically" s
+	DEFINE_string signingkey "" "use the given GPG-key for the digital signature (implies -s)" u
+	DEFINE_string message "" "use the given tag message" m
 	parse_args "$@"
 	require_version_arg
 
+	# handle flags that imply other flags
+	if [ "$FLAGS_signingkey" != "" ]; then
+		FLAGS_sign=$FLAGS_TRUE
+	fi
+
 	# sanity checks
+	gitflow_require_branch $BRANCH
 	gitflow_require_clean_working_tree
 	if flag fetch; then
-		git fetch -q $ORIGIN $MASTER_BRANCH
-		git fetch -q $ORIGIN $DEVELOP_BRANCH
+		git fetch -q $ORIGIN $MASTER_BRANCH || \
+		  die "Could not fetch $MASTER_BRANCH from $ORIGIN."
+		git fetch -q $ORIGIN $DEVELOP_BRANCH || \
+		  die "Could not fetch $DEVELOP_BRANCH from $ORIGIN."
 	fi
 	gitflow_require_branches_equal $MASTER_BRANCH $ORIGIN/$MASTER_BRANCH
 	gitflow_require_branches_equal $DEVELOP_BRANCH $ORIGIN/$DEVELOP_BRANCH
 
 	# merge into master
-	git checkout $MASTER_BRANCH
-	git merge --no-ff $BRANCH
-	git tag $VERSION_PREFIX$VERSION
+	git checkout $MASTER_BRANCH || \
+	  die "Could not check out $MASTER_BRANCH."
+	git merge --no-ff $BRANCH	# TODO: This can fail!
 
-	# merge into develop if we fixed a master issue
-	git checkout $DEVELOP_BRANCH
-	git merge --no-ff $BRANCH
+	typeset opts="-a"
+	flag sign && opts="$opts -s"
+	[ "$FLAGS_signingkey" != "" ] && opts="$opts -u '$FLAGS_signingkey'"
+	[ "$FLAGS_message" != "" ] && opts="$opts -m '$FLAGS_message'"
+	git tag $opts "$VERSION_PREFIX$VERSION" || \
+	  die "Tagging failed. Please run finish again to retry."
+
+	# merge into develop
+	git checkout $DEVELOP_BRANCH || \
+	  die "Could not check out $DEVELOP_BRANCH."
+	git merge --no-ff $BRANCH	# TODO: This can fail!
 
 	# delete branch
 	git branch -d $BRANCH