diff --git a/metropolis/node/core/cluster/cluster.go b/metropolis/node/core/cluster/cluster.go
index 1de24f3..4df489d 100644
--- a/metropolis/node/core/cluster/cluster.go
+++ b/metropolis/node/core/cluster/cluster.go
@@ -42,7 +42,6 @@
 
 	"source.monogon.dev/metropolis/node"
 	"source.monogon.dev/metropolis/node/core/consensus"
-	"source.monogon.dev/metropolis/node/core/identity"
 	"source.monogon.dev/metropolis/node/core/localstorage"
 	"source.monogon.dev/metropolis/node/core/network"
 	"source.monogon.dev/metropolis/node/core/roleserve"
@@ -257,12 +256,11 @@
 // logClusterDirectory verbosely logs the whole Cluster Directory passed to it.
 func logClusterDirectory(ctx context.Context, cd *cpb.ClusterDirectory) {
 	for _, node := range cd.Nodes {
-		id := identity.NodeID(node.PublicKey)
 		var addresses []string
 		for _, add := range node.Addresses {
 			addresses = append(addresses, add.Host)
 		}
-		supervisor.Logger(ctx).Infof("    Node ID: %s, Addresses: %s", id, strings.Join(addresses, ","))
+		supervisor.Logger(ctx).Infof("    Addresses: %s", strings.Join(addresses, ","))
 	}
 }
 
diff --git a/metropolis/node/core/cluster/cluster_register.go b/metropolis/node/core/cluster/cluster_register.go
index c348c32..f2ccbff 100644
--- a/metropolis/node/core/cluster/cluster_register.go
+++ b/metropolis/node/core/cluster/cluster_register.go
@@ -59,6 +59,14 @@
 		}
 	}
 
+	// Strip the initial ClusterDirectory of any node public keys that might have
+	// been included, as it can't be relied on beyond providing cluster endpoint
+	// addresses, considering its untrusted origin (ESP). This explicitly enforces
+	// suggested usage described in ClusterDirectory's protofile.
+	for i, _ := range register.ClusterDirectory.Nodes {
+		register.ClusterDirectory.Nodes[i].PublicKey = nil
+	}
+
 	// Validation passed, let's take the state lock and start working on registering
 	// us into the cluster.