Index: usr.sbin/uefisign/uefisign.c
===================================================================
--- usr.sbin/uefisign/uefisign.c
+++ usr.sbin/uefisign/uefisign.c
@@ -349,13 +349,22 @@
 			Vflag = true;
 			break;
 		case 'c':
-			certpath = checked_strdup(optarg);
+			if (certpath == NULL)
+				certpath = checked_strdup(optarg);
+			else
+				err(1, "-c can only be specified once");
 			break;
 		case 'k':
-			keypath = checked_strdup(optarg);
+			if (keypath == NULL)
+				keypath = checked_strdup(optarg);
+			else
+				err(1, "-k can only be specified once");
 			break;
 		case 'o':
-			outpath = checked_strdup(optarg);
+			if (outpath == NULL)
+				outpath = checked_strdup(optarg);
+			else
+				err(1, "-o can only be specified once");
 			break;
 		case 'v':
 			vflag = true;
@@ -401,7 +410,7 @@
 		err(1, "fork");
 
 	if (pid == 0)
-		return (child(inpath, outpath, pipefds[1], Vflag, vflag));
+		exit(child(inpath, outpath, pipefds[1], Vflag, vflag));
 
 	if (!Vflag) {
 		certfp = checked_fopen(certpath, "r");
@@ -421,5 +430,5 @@
 		sign(cert, key, pipefds[0]);
 	}
 
-	return (wait_for_child(pid));
+	exit(wait_for_child(pid));
 }