diff --git a/verifiers/internal/vsa/verifier_test.go b/verifiers/internal/vsa/verifier_test.go
index 98936cc..11d5c9b 100644
--- a/verifiers/internal/vsa/verifier_test.go
+++ b/verifiers/internal/vsa/verifier_test.go
@@ -133,6 +133,44 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeGa6ZCZn0q6WpaUwJrSk+PPYEsca
 			},
 			expectedVSA: goodVSA,
 		},
+		{
+			name: "success: no key ids",
+			envelope: &dsse.Envelope{
+				PayloadType: goodEnvelope.PayloadType,
+				Payload:     goodEnvelope.Payload,
+				Signatures: []dsse.Signature{
+					{
+						KeyID: "",
+						Sig:   goodEnvelope.Signatures[0].Sig,
+					},
+				},
+			},
+			opts: &options.VerificationOpts{
+				PublicKey:         goodVSAOpts.PublicKey,
+				PublicKeyID:       pointerTo(""),
+				PublicKeyHashAlgo: crypto.SHA256,
+			},
+			expectedVSA: goodVSA,
+		},
+		{
+			name: "success: keyid only in opts",
+			envelope: &dsse.Envelope{
+				PayloadType: goodEnvelope.PayloadType,
+				Payload:     goodEnvelope.Payload,
+				Signatures: []dsse.Signature{
+					{
+						KeyID: "",
+						Sig:   goodEnvelope.Signatures[0].Sig,
+					},
+				},
+			},
+			opts: &options.VerificationOpts{
+				PublicKey:         goodVSAOpts.PublicKey,
+				PublicKeyID:       pointerTo("SHA256:Zphi7kubaI7RnOrkqPgkRdVhF5a2JOFB4gor/Zajiiw"),
+				PublicKeyHashAlgo: crypto.SHA256,
+			},
+			expectedVSA: goodVSA,
+		},
 		{
 			name: "failure: empty signatures",
 			envelope: &dsse.Envelope{