let `cli -h` emit list of supported signature algorithms, run tests based on that
diff --git a/t/cli.c b/t/cli.c
index bf21b81..db6bf82 100644
--- a/t/cli.c
+++ b/t/cli.c
@@ -379,6 +379,17 @@
 #if PTLS_OPENSSL_HAVE_X25519
            ", X25519"
 #endif
+           "\n"
+           "Supported signature algorithms: rsa, secp256r1"
+#if PTLS_OPENSSL_HAVE_SECP384R1
+           ", secp384r1"
+#endif
+#if PTLS_OPENSSL_HAVE_SECP521R1
+           ", secp521r1"
+#endif
+#if PTLS_OPENSSL_HAVE_ED25519
+           ", ed25519"
+#endif
            "\n\n",
            cmd);
 }
diff --git a/t/e2e.t b/t/e2e.t
index 4430a6b..ada3109 100755
--- a/t/e2e.t
+++ b/t/e2e.t
@@ -72,7 +72,15 @@
 
 # This test acts as an end-to-end testing of the certificate verifier of the OpenSSL backend.
 subtest "raw-public-keys" => sub {
-    for my $key_type (qw(rsa secp256r1 secp384r1 secp521r1 ed25519)) {
+    my @key_types = do {
+        my $help = `$cli -h`;
+        $help =~ /^Supported signature algorithms:\s*(.*)\s*$/m
+            or die "failed to extract list of supported signature algorithms from $cli -h";
+        split /,\s*/, $1;
+    };
+    die "unexpected list of supported signature algorithms: @key_types"
+        unless grep /^rsa$/, @key_types;
+    for my $key_type (@key_types) {
         subtest $key_type => sub {
             my $guard = spawn_server($key_type, qw(-r - -i t/assets/hello.txt));
             my $resp = `$cli -v -r t/assets/$key_type/pub.pem 127.0.0.1 $port 2> /dev/null`;