Authenticate selective catalog base pairs

tools/release/release-catalog.py

@@ -33,7 +33,20 @@ def main() -> int:
             "will be computed into the signed catalog; may be repeated."
         ),
     )
-    selective.add_argument("--base-catalog", help="Catalog path or URL to use as the source. Defaults to local channel, then public channel.")
+    selective.add_argument(
+        "--base-catalog",
+        help=(
+            "Authenticated catalog path or URL to use as the source; must be "
+            "paired with --base-keyring. Defaults to the local pair, then public pair."
+        ),
+    )
+    selective.add_argument(
+        "--base-keyring",
+        help=(
+            "Exact keyring path or URL pinned by --base-catalog and matching "
+            "the configured catalog signer set."
+        ),
+    )
     selective.add_argument(
         "--output-dir",
         type=Path,
@@ -84,6 +97,7 @@ def main() -> int:
             workspace_root=args.workspace_root,
             output_dir=args.output_dir,
             base_catalog=args.base_catalog,
+            base_keyring=args.base_keyring,
             signing_keys=tuple(args.catalog_signing_key),
             public_base_url=args.public_base_url,
             repository_base=args.repository_base,