diff --git a/cheeto/__main__.py b/cheeto/__main__.py
index 1743634..2af6d9b 100644
--- a/cheeto/__main__.py
+++ b/cheeto/__main__.py
@@ -81,6 +81,7 @@ def main():
     database.site_write_to_puppet(site_commands)
     database.site_sync_to_ldap(site_commands)
     database.site_write_to_sympa(site_commands)
+    database.site_write_root_key(site_commands)
 
     user_parser = database_commands.add_parser('user')
     user_parser.set_defaults(func = lambda _: user_parser.print_help())
diff --git a/cheeto/database.py b/cheeto/database.py
index bef6269..1747e5a 100644
--- a/cheeto/database.py
+++ b/cheeto/database.py
@@ -1546,6 +1546,23 @@ def site_write_to_sympa(args: argparse.Namespace):
                 print(user.email, file=fp)
 
 
+@subcommand('root-key',
+            add_site_args_req,
+            lambda parser: parser.add_argument('output_txt', type=Path))
+def site_write_root_key(args: argparse.Namespace):
+    connect_to_database(args.config.mongo)
+
+    with args.output_txt.open('w') as fp:
+        for user in SiteUser.objects(sitename=args.site,
+                                     parent__in=GlobalUser.objects(type='admin')):
+            if 'root-ssh' in user.access:
+                if user.ssh_key:
+                    print(f'# {user.username} <{user.email}>', file=fp)
+                for key in user.ssh_key:
+                    print(key, file=fp)
+
+
+
 #########################################
 #
 # load commands: cheeto database load ...