diff --git a/tools/dune b/tools/dune
index 3375a448..3366e550 100644
--- a/tools/dune
+++ b/tools/dune
@@ -2,4 +2,4 @@
  (public_name offline)
  (name offline)
  (modules offline)
- (libraries cmdliner bos fmt mirage-crypto ptime mte))
+ (libraries cmdliner bos fmt mirage-crypto ptime mte vif))
diff --git a/tools/offline.ml b/tools/offline.ml
index 5d06c89b..cea32ef7 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -1 +1,53 @@
-let () = Fmt.pr "hello~@."; ()
+let download ~output_file =
+  Miou_unix.run @@ fun () ->
+  let fn _meta _req _resp () data_opt =
+    (*
+    let () =
+      match response.Httpcats.status with
+      | #Httpcats.Status.successful -> ()
+      | _ ->
+          Fmt.failwith "Download failure: `%a`." Httpcats.Status.pp_hum
+            response.status
+    in
+    let data =
+      match data_opt with
+      | Some data -> data
+      | None -> Fmt.failwith "Download failure: no data received."
+    in
+    *)
+    match data_opt with
+    | None -> Fmt.failwith "Download failure: no data received."
+    | Some data -> (
+        let output_file = Fpath.v output_file in
+        match Bos.OS.File.write output_file data with
+        | Error (`Msg err) -> Fmt.failwith "Write failure: `%s`." err
+        | Ok () -> ())
+  in
+  let uri = "http://localhost:3434/management/keys/" in
+  let rng = Mirage_crypto_rng_miou_unix.(initialize (module Pfortuna)) in
+  let _ = Httpcats.request ~fn ~uri () in
+  Mirage_crypto_rng_miou_unix.kill rng;
+  ()
+
+(* CLI *)
+
+open Cmdliner
+open Cmdliner.Term.Syntax
+
+let output =
+  let doc = "File to save data to be signed." in
+  Arg.(
+    value & opt filepath "management_keys.json" & info [ "o"; "output" ] ~doc)
+
+let download_cmd =
+  let doc = "Downloads /management/keys/" in
+  let man =
+    [ `S Manpage.s_description; `P "$(cmd) download /management/keys." ]
+  in
+  Cmd.make (Cmd.info "offline" ~version:"%%VERSION%%" ~doc ~man)
+  @@
+  let+ output_file = output in
+  download ~output_file
+
+let main () = Cmd.eval download_cmd
+let () = if !Sys.interactive then () else exit (main ())