diff --git a/pkg/crypto/keys/publickey.go b/pkg/crypto/keys/publickey.go
index 5d1e5ce41..774623456 100644
--- a/pkg/crypto/keys/publickey.go
+++ b/pkg/crypto/keys/publickey.go
@@ -78,8 +78,12 @@ func (keys PublicKeys) Contains(pKey *PublicKey) bool {
 	return false
 }
 
-// Copy returns a copy of keys.
+// Copy returns a shallow copy of the PublicKeys slice. It creates a new slice with the same elements,
+// but does not perform a deep copy of the elements themselves.
 func (keys PublicKeys) Copy() PublicKeys {
+	if keys == nil {
+		return nil
+	}
 	res := make(PublicKeys, len(keys))
 	copy(res, keys)
 	return res
diff --git a/pkg/crypto/keys/publickey_test.go b/pkg/crypto/keys/publickey_test.go
index d22c0d090..1f05c7b30 100644
--- a/pkg/crypto/keys/publickey_test.go
+++ b/pkg/crypto/keys/publickey_test.go
@@ -40,6 +40,8 @@ func TestEncodeDecodePublicKey(t *testing.T) {
 }
 
 func TestPublicKeys_Copy(t *testing.T) {
+	require.Nil(t, (PublicKeys)(nil).Copy())
+
 	pubs := make(PublicKeys, 5)
 	for i := range pubs {
 		priv, err := NewPrivateKey()