diff --git a/NEWS.markdown b/NEWS.markdown
index 7ea26d9..a3bc0a9 100644
--- a/NEWS.markdown
+++ b/NEWS.markdown
@@ -1,6 +1,14 @@
 xen-tools 4.6.3 (released NOT YET)
 ==================================
 
+New Features
+------------
+
+* Support situations where distributions (e.g. Squeeze) might be end
+  of life, but its archive signing key is still not removed from the
+  default keyring. (As of this writing, that's the case for Debian 6
+  Squeeze on Debian 8 Jessie.)
+
 Bug Fixes
 ---------
 
diff --git a/bin/xen-create-image b/bin/xen-create-image
index 72beea6..3c77856 100755
--- a/bin/xen-create-image
+++ b/bin/xen-create-image
@@ -1292,7 +1292,9 @@ sub setupDefaultOptions
                     $CONFIG{ 'mirror_'.$debdist } = $MIRROR{$dist.'_archive'} or
                         die $dist.'_archive not defined in /etc/xen-tools/mirrors.conf';
                     my $removed_keys = "/usr/share/keyrings/$dist-archive-removed-keys.gpg";
-                    $CONFIG{ 'keyring_'.$debdist } = $removed_keys if -s $removed_keys;
+                    if ($debdistinfo !~ /default-keyring/ and -s $removed_keys) {
+                        $CONFIG{ 'keyring_'.$debdist } = $removed_keys;
+                    }
                 } else {
                     $CONFIG{ 'mirror_'.$debdist } = $MIRROR{$dist} or
                         die $dist.' not defined in /etc/xen-tools/mirrors.conf';
diff --git a/debian/changelog b/debian/changelog
index 0a5ca64..8816765 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -18,6 +18,9 @@ xen-tools (4.6.3~dev-1) UNRELEASED; urgency=medium
       (Closes: #842609)
     + Fixes possible missing gateway in generated
       /etc/network/interfaces. (Closes: #764625)
+    + Support situations where distributions (e.g. Squeeze) might be EoL,
+      but its archive signing key is still not removed from the default
+      keyring.
   * Declare compliance with Debian Policy 3.9.8. (No changes needed.)
   * Use NEWS.markdown as upstream changelog, don't install it as docs.
   * Switch many URLs (upstream and in packaging) to https:// and update
diff --git a/etc/distributions.conf b/etc/distributions.conf
index 0bfe926..94ce1a0 100644
--- a/etc/distributions.conf
+++ b/etc/distributions.conf
@@ -5,12 +5,12 @@
 # codename = distribution and further keywords
 #
 # Known distributions: debian, ubuntu
-# Known keywords: eol, pygrub
+# Known keywords: eol, pygrub, default-keyring
 #
 sarge        = debian eol
 etch         = debian eol
 lenny        = debian eol
-squeeze      = debian eol
+squeeze      = debian eol default-keyring
 wheezy       = debian
 jessie       = debian
 stretch      = debian