TRUST THE KEY · NOT THE DOMAIN

What PGP Is and How to Verify a Torzon Signature

Q: What does a PGP signature actually prove?

It proves a file was signed by the holder of a specific private key and has not changed since. It says nothing about which website served it, so the key is what you trust.

Q: gpg says Good signature but shows a warning. Is that fine?

A Good signature line means the math checked out. A trust warning only means you have not marked the key as trusted in your keyring. Confirm the fingerprint yourself and it is fine.

Q: The page looks identical to the real one. Is that enough?

No. Layout, wording, and a green status badge are all copyable. A signature is not. Verify the file, not the look.

Q: Do I still need PGP if the onion address matches?

Matching the address is a good first pass, but the signed directory can list several mirrors. PGP is what ties that whole list to one key you can check offline.

PGP is the check that separates a real Torzon signature from a page that only looks correct. It lets you confirm who signed a file and whether anyone altered it, without trusting the site that handed it to you.

PGPSignature check

40-hexKey fingerprint

gpg--verify

OfflineChecked locally

WHAT PGP ISplain answer

PGP in one plain paragraph

PGP stands for Pretty Good Privacy. In practice it gives one person a private key they keep secret and a public key they hand out. When they sign a file with the private key, anyone holding the public key can confirm two things: the file came from that key, and not one byte changed on the way. That is the whole idea, and it is why a signature beats a screenshot.

A signature is a small proof attached to a file. It does not hide anything and it does not encrypt the address list. It only answers the question of who signed this, and was it touched after.

KEY OVER DOMAINthe core rule

Why a reader trusts the key, not the address bar

A clone can copy a Torzon page down to the last pixel and buy a name one letter off. What it cannot do is sign a directory with the canon private key, because that key never leaves the owner. So the safe habit is simple: decide what to trust by the signature, then let the address follow from the signed list.

One secret key

Only the canon holder can produce a valid signature. A phishing site has the look but not the key.

Tamper-evident

Change a single character in the address list and the signature stops verifying. There is no quiet edit.

Checked offline

You run the check on your own machine. The result does not depend on the server being honest.

Portable proof

The same signature verifies anywhere. Move the file to another device and the answer is the same.

HOW VERIFICATION WORKSour diagram

How a signature check runs, end to end

Three things meet on your machine: the signed file, the detached signature, and the public key you imported. gpg does the arithmetic and returns one of two answers. Here is that path drawn out.

1 · Gather three filesThe signed release, its detached signature, and the public key you already imported.

2 · Run the checkgpg compares the signature against the file using the key. No network is involved.

3 · Read one answerGood means it holds. Anything else, treat the file as untrusted and stop.

IMPORT AND VERIFYthe commands

Import the key, then run gpg --verify

Save the published public key as canon-pub.asc.
Run gpg --import canon-pub.asc to add it.
Read the fingerprint and match it to the canon.
Fetch the signed list and its .sig file.
Run gpg --verify and require a Good line.

gpg --import canon-pub.asc
gpg --fingerprint            # compare with the canon
gpg --verify mirrors.json.sig mirrors.json

The signed directory lives at mirrors.json, and the primary reference address on the canon reads http://torzonguqmlfy2kfi5tjbnt4bp3idtkjzi4qtupmhpdihjftomjtdzqd.onion. Compare, never guess.

SIGNED VS LOOK-ALIKEside by side

What a signature catches that your eyes miss

A signed release

Verifies against the canon key. The fingerprint matches on your own machine. The address list is exact, and gpg prints Good.

A convincing clone

Same colours, same wording, a badge that says verified. No valid signature, or a key whose fingerprint does not match. That gap is the tell.

If you can only do one check, do this one. A page that cannot produce a matching signature has failed, however polished it looks.

FAQplain answers

Frequently asked questions

What does a PGP signature actually prove?

It proves a file was signed by the holder of one private key and has not changed since. It says nothing about which website served it, which is exactly why the key is the thing you trust.

How do I import the Torzon key?

Save the published public key to a file and run gpg --import on it. Then read back the fingerprint and compare it, character by character, with the one shown on the canon home page.

What is a fingerprint, and why compare it?

A fingerprint is a short hash of the whole key. Two different keys will not share one, so matching it confirms you imported the intended key and not a swapped copy.

gpg says Good signature but also a warning. Is that fine?

The Good line means the math checked out. A trust warning only means you have not marked the key as trusted in your keyring. Confirm the fingerprint by hand and you are done.

The page looks identical to the real one. Is that enough?

No. Layout, wording, and a status badge are all easy to copy. A signature is not. Check the file with the URL validator and the key, then decide.

Do I still need PGP if the onion address matches?

Matching the address is a good first pass, but the signed list can hold several mirrors. PGP is what ties that whole list to one key you can check offline, which is why the access guide puts it first.