diff --git a/asmap-verify b/asmap-verify
index 7d6aedcba8..a8946853f4 100755
--- a/asmap-verify
+++ b/asmap-verify
@@ -33,7 +33,9 @@ check_tools() {
     done
 }
 
-check_tools cat diff gpg basename date
+GPG=${GPG:-gpg}
+
+check_tools cat diff basename date "$GPG"
 
 ################
 # Usage
@@ -112,7 +114,7 @@ verify() {
     local signer_name
     signer_name="$(basename "$(dirname "$current_manifest")")"
 
-    if ! gpg --quiet --batch \
+    if ! "${GPG}" --quiet --batch \
             --verify "${current_manifest}.asc" "$current_manifest" 1>&2; then
         echo "ERR: Failed to verify GPG signature for signer '${signer_name}'"
         echo "     Manifest:  '${current_manifest}'"
@@ -120,10 +122,10 @@ verify() {
         echo ""
         echo "Hint: Either the signature is invalid or the public key is not in"
         echo "      your GPG keyring. You can import it with:"
-        echo "          gpg --import '${builder_keys_dir}/${signer_name}.gpg'"
+        echo "          ${GPG} --import '${builder_keys_dir}/${signer_name}.gpg'"
         echo ""
         failure=1
-    elif ! diff --report-identical "$compare_base" "$current_manifest" 1>&2; then
+    elif ! diff -s "$compare_base" "$current_manifest" 1>&2; then
         echo "ERR: The SHA256SUMS attestation differs from the compare base:"
         echo "    base:    '${compare_base}'"
         echo "    current: '${current_manifest}'"