diff --git a/router/java/src/net/i2p/router/startup/LoadRouterInfoJob.java b/router/java/src/net/i2p/router/startup/LoadRouterInfoJob.java
index c91b6991cf4c1c460671a1d70cf5a8fe7744c6f0..8ff2f889274119789788519970786f124927a5da 100644
--- a/router/java/src/net/i2p/router/startup/LoadRouterInfoJob.java
+++ b/router/java/src/net/i2p/router/startup/LoadRouterInfoJob.java
@@ -104,11 +104,32 @@ class LoadRouterInfoJob extends JobImpl {
                 if (_log.shouldLog(Log.DEBUG))
                     _log.debug("Reading in routerInfo from " + rif.getAbsolutePath() + " and it has " + info.getAddresses().size() + " addresses");
                 // don't reuse if family name changed
-                if (DataHelper.eq(info.getOption(FamilyKeyCrypto.OPT_NAME),
-                                  getContext().getProperty(FamilyKeyCrypto.PROP_FAMILY_NAME))) {
+                String oldFamily = info.getOption(FamilyKeyCrypto.OPT_NAME);
+                if (oldFamily == null) {
                     _us = info;
+                } else if (oldFamily.equals(getContext().getProperty(FamilyKeyCrypto.PROP_FAMILY_NAME))) {
+                    // This keeps the signature the same across restarts,
+                    // which is good because ECDSA creates a different signature each time,
+                    // but in some situations such as leaving and re-joining or recreating a family,
+                    // or copying router.info to a new router,
+                    // could lead to a bad signature being perpetuated forever.
+                    // Here we ignore and delete router.info if the sig is invalid.
+                    FamilyKeyCrypto fkc = getContext().router().getFamilyKeyCrypto();
+                    if (fkc != null && fkc.verifyOurFamily(info)) {
+                        _us = info;
+                    } else {
+                        _log.logAlways(Log.WARN, "NetDb family keys are invalid");
+                        // close and delete so we don't infinite loop
+                        try { fis1.close(); } catch (IOException ioe2) {}
+                        fis1 = null;
+                        rif.delete();
+                    }
                 } else {
                     _log.logAlways(Log.WARN, "NetDb family name changed");
+                    // close and delete so we don't infinite loop
+                    try { fis1.close(); } catch (IOException ioe2) {}
+                    fis1 = null;
+                    rif.delete();
                 }
             }