Verifying
Fourteen claims in this register end here. The setup is careful work done once, and every check afterwards is mechanical.
The fingerprint comes first
A key is a large blob you cannot inspect. A fingerprint is a short hash of it, short enough to compare by eye and long enough that nobody can produce a second key matching it. You pin the fingerprint and treat key files as disposable, which reverses the usual instinct.
The key file needs no protection at all. It is public and can be fetched from anywhere including somewhere hostile, then checked against the fingerprint you hold. Only the fingerprint has to be right.
Establishing it, once
- Collect it from several places. Independent means they would have to be compromised separately. Three pages by one operator count as one source, and three sites that copied a fourth also count as one.
- Compare in full. The whole string, character by character, not the first four and last four.
- Write it down somewhere you control. Paper works well because it cannot be edited by anything running on your machine.
- If sources disagree, stop and wait. At least one is wrong and you cannot tell which. This is not a majority vote.
The check, every time
- Find the signed block. It starts and ends with the armour lines. No signed block means you are finished and the answer is no.
- Copy the whole thing, nothing trimmed, no whitespace altered, no quotation marks converted. A partial copy fails in a way that looks identical to tampering.
- Verify against your pinned key. Not one the page offers, not one you fetched because verification complained.
- Read the output. Both the key ID and the date inside the signed text.
The four outcomes
| Result | Meaning | Do |
|---|---|---|
| BAD signature | Text altered or signature fabricated | Leave. No judgement needed. |
| No public key | Signed by a key you do not hold | Import the right key after checking its fingerprint, never one the page hands you. |
| GOOD, unexpected key | Maths works against a key that is not yours | Leave. The word GOOD appears, which is why this catches people. |
| GOOD, old date | Verifies, statement is months old | Treat as unconfirmed. Signatures never expire, so genuine old ones get replayed. |
What it cannot tell you
That the signer is honest, that your own machine is trustworthy, or anything about what happens after you log in. It answers one question completely, which is whether you are where you think you are, and nothing else available answers it at all. That narrowness is exactly why it is worth doing and why it is not a substitute for the rest.