diff --git a/git-flow-hotfix b/git-flow-hotfix
index 7ffa39b..9b9974e 100644
--- a/git-flow-hotfix
+++ b/git-flow-hotfix
@@ -113,7 +113,7 @@
 }
 
 cmd_start() {
-	DEFINE_boolean fetch true "fetch from $ORIGIN before finishing hotfix" F
+	DEFINE_boolean fetch true "fetch from $ORIGIN before performing finish" F
 	parse_args "$@"
 	BASE="${2:-$MASTER_BRANCH}"
 	require_version_arg
@@ -121,11 +121,12 @@
 
 	# sanity checks
 	gitflow_require_clean_working_tree
+	gitflow_require_branch_absent $BRANCH
+	gitflow_require_tag_absent $VERSION_PREFIX$VERSION
 	if flag fetch; then
 		git fetch -q $ORIGIN $MASTER_BRANCH
 	fi
 	gitflow_require_branches_equal $MASTER_BRANCH $ORIGIN/$MASTER_BRANCH
-	gitflow_require_branch_absent $BRANCH
 
 	# create branch
 	git checkout -b $BRANCH $BASE
@@ -145,27 +146,46 @@
 }
 
 cmd_finish() {
-	DEFINE_boolean fetch true "fetch from $ORIGIN before finishing hotfix" F
+	DEFINE_boolean fetch true "fetch from $ORIGIN before performing finish" F
+	DEFINE_boolean sign false "sign the release tag cryptographically" s
+	DEFINE_string signingkey "" "use the given GPG-key for the digital signature (implies -s)" u
+	DEFINE_string message "" "use the given tag message" m
 	parse_args "$@"
 	require_version_arg
 
+	# handle flags that imply other flags
+	if [ "$FLAGS_signingkey" != "" ]; then
+		FLAGS_sign=$FLAGS_TRUE
+	fi
+
 	# sanity checks
+	gitflow_require_branch $BRANCH
 	gitflow_require_clean_working_tree
 	if flag fetch; then
-		git fetch -q $ORIGIN $MASTER_BRANCH
-		git fetch -q $ORIGIN $DEVELOP_BRANCH
+		git fetch -q $ORIGIN $MASTER_BRANCH || \
+		  die "Could not fetch $MASTER_BRANCH from $ORIGIN."
+		git fetch -q $ORIGIN $DEVELOP_BRANCH || \
+		  die "Could not fetch $DEVELOP_BRANCH from $ORIGIN."
 	fi
 	gitflow_require_branches_equal $MASTER_BRANCH $ORIGIN/$MASTER_BRANCH
 	gitflow_require_branches_equal $DEVELOP_BRANCH $ORIGIN/$DEVELOP_BRANCH
 
 	# merge into master
-	git checkout $MASTER_BRANCH
-	git merge --no-ff $BRANCH
-	git tag $VERSION_PREFIX$VERSION
+	git checkout $MASTER_BRANCH || \
+	  die "Could not check out $MASTER_BRANCH."
+	git merge --no-ff $BRANCH	# TODO: This can fail!
 
-	# merge into develop if we fixed a master issue
-	git checkout $DEVELOP_BRANCH
-	git merge --no-ff $BRANCH
+	typeset opts="-a"
+	flag sign && opts="$opts -s"
+	[ "$FLAGS_signingkey" != "" ] && opts="$opts -u '$FLAGS_signingkey'"
+	[ "$FLAGS_message" != "" ] && opts="$opts -m '$FLAGS_message'"
+	git tag $opts "$VERSION_PREFIX$VERSION" || \
+	  die "Tagging failed. Please run finish again to retry."
+
+	# merge into develop
+	git checkout $DEVELOP_BRANCH || \
+	  die "Could not check out $DEVELOP_BRANCH."
+	git merge --no-ff $BRANCH	# TODO: This can fail!
 
 	# delete branch
 	git branch -d $BRANCH
diff --git a/git-flow-release b/git-flow-release
index 8fb4061..03832b7 100644
--- a/git-flow-release
+++ b/git-flow-release
@@ -127,11 +127,12 @@
 
 	# sanity checks
 	gitflow_require_clean_working_tree
+	gitflow_require_branch_absent $BRANCH
+	gitflow_require_tag_absent $VERSION_PREFIX$VERSION
 	if flag fetch; then
 		git fetch -q $ORIGIN $DEVELOP_BRANCH
 	fi
 	gitflow_require_branches_equal $DEVELOP_BRANCH $ORIGIN/$DEVELOP_BRANCH
-	gitflow_require_branch_absent $BRANCH
 
 	# create branch
 	git checkout -b $BRANCH $BASE
@@ -152,26 +153,45 @@
 
 cmd_finish() {
 	DEFINE_boolean fetch true "fetch from $ORIGIN before performing finish" F
+	DEFINE_boolean sign false "sign the release tag cryptographically" s
+	DEFINE_string signingkey "" "use the given GPG-key for the digital signature (implies -s)" u
+	DEFINE_string message "" "use the given tag message" m
 	parse_args "$@"
 	require_version_arg
 
+	# handle flags that imply other flags
+	if [ "$FLAGS_signingkey" != "" ]; then
+		FLAGS_sign=$FLAGS_TRUE
+	fi
+
 	# sanity checks
+	gitflow_require_branch $BRANCH
 	gitflow_require_clean_working_tree
 	if flag fetch; then
-		git fetch -q $ORIGIN $MASTER_BRANCH
-		git fetch -q $ORIGIN $DEVELOP_BRANCH
+		git fetch -q $ORIGIN $MASTER_BRANCH || \
+		  die "Could not fetch $MASTER_BRANCH from $ORIGIN."
+		git fetch -q $ORIGIN $DEVELOP_BRANCH || \
+		  die "Could not fetch $DEVELOP_BRANCH from $ORIGIN."
 	fi
 	gitflow_require_branches_equal $MASTER_BRANCH $ORIGIN/$MASTER_BRANCH
 	gitflow_require_branches_equal $DEVELOP_BRANCH $ORIGIN/$DEVELOP_BRANCH
 
 	# merge into master
-	git checkout $MASTER_BRANCH
-	git merge --no-ff $BRANCH
-	git tag $VERSION_PREFIX$VERSION
+	git checkout $MASTER_BRANCH || \
+	  die "Could not check out $MASTER_BRANCH."
+	git merge --no-ff $BRANCH	# TODO: This can fail!
+
+	typeset opts="-a"
+	flag sign && opts="$opts -s"
+	[ "$FLAGS_signingkey" != "" ] && opts="$opts -u '$FLAGS_signingkey'"
+	[ "$FLAGS_message" != "" ] && opts="$opts -m '$FLAGS_message'"
+	git tag $opts "$VERSION_PREFIX$VERSION" || \
+	  die "Tagging failed. Please run finish again to retry."
 
 	# merge into develop
-	git checkout $DEVELOP_BRANCH
-	git merge --no-ff $BRANCH
+	git checkout $DEVELOP_BRANCH || \
+	  die "Could not check out $DEVELOP_BRANCH."
+	git merge --no-ff $BRANCH	# TODO: This can fail!
 
 	# delete branch
 	git branch -d $BRANCH
diff --git a/gitflow-common b/gitflow-common
index 2fbd8ec..c96b845 100644
--- a/gitflow-common
+++ b/gitflow-common
@@ -42,6 +42,7 @@
 LOCAL_BRANCHES=$(git branch | sed 's/^[* ] //')
 REMOTE_BRANCHES=$(git branch -r | sed 's/^[* ] //')
 ALL_BRANCHES="$LOCAL_BRANCHES $REMOTE_BRANCHES"
+ALL_TAGS=$(git tag)
 
 #
 # resolve_nameprefix
@@ -141,6 +142,12 @@
 	fi
 }
 
+gitflow_require_tag_absent() {
+	if has $1 $ALL_TAGS; then
+		die "Tag '$1' already exists. Pick another name."
+	fi
+}
+
 #
 # gitflow_test_branches_equal()
 #