diff --git a/src/server.rs b/src/server.rs
index 94d11ab..e794df4 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -19,7 +19,7 @@ use secrecy::ExposeSecret;
 use ssh_key::public::PublicKey;
 use ssh_key::Certificate;
 use ssh_key::Fingerprint;
-use tracing::{debug, error, warn};
+use tracing::{debug, error, info, warn};
 use yaml_rust::YamlLoader;
 
 use super::Context;
@@ -78,6 +78,7 @@ impl FromRequestParts<Arc<Context>> for Auth {
             warn!("Invalid certificate");
             Self::unauthorized()
         })?;
+        debug!("Successfully validated certificate from request: {:?}", cert);
         Ok(Self(cert))
     }
 }
@@ -115,6 +116,7 @@ async fn dispense_keys(
                     all_keys.push(b'\n');
                 }
             }
+            info!("Encrypted {} keys for {}", keys.len(), princ);
         }
     }
     let pubkey = PublicKey::new(cert.public_key().clone(), "");
@@ -179,6 +181,7 @@ fn encrypt(
 /// to a list of keys the principal is authorized to have.
 fn load_map(path: impl AsRef<Path>) -> HashMap<String, Vec<String>> {
     let path = path.as_ref();
+    debug!("Loading key map from {}", path.display());
     let mut map = Default::default();
     let contents = match std::fs::read_to_string(path) {
         Ok(c) => c,
@@ -212,6 +215,7 @@ fn load_map(path: impl AsRef<Path>) -> HashMap<String, Vec<String>> {
             }
         }
     }
+    debug!("Loaded key map for {} principals", map.keys().len());
     map
 }