What PGP Is and How to Verify a Torzon Signature in 2026

PGP in one plain paragraph

PGP stands for Pretty Good Privacy. In practice it gives one person a private key they keep secret and a public key they hand out. When they sign a file with the private key, anyone holding the public key can confirm two things: the file came from that key, and not one byte changed on the way. That is the whole idea, and it is why a signature beats a screenshot.

A signature is a small proof attached to a file. It does not hide anything and it does not encrypt the address list. It only answers the question of who signed this, and was it touched after.

Why a reader trusts the key, not the address bar

A clone can copy a Torzon page down to the last pixel and buy a name one letter off. What it cannot do is sign a directory with the canon private key, because that key never leaves the owner. So the safe habit is simple: decide what to trust by the signature, then let the address follow from the signed list.

Import the key, then run gpg --verify

1. Save the published public key as canon-pub.asc.
2. Run gpg --import canon-pub.asc to add it.
3. Read the fingerprint and match it to the canon.
4. Fetch the signed list and its .sig file.
5. Run gpg --verify and require a Good line.

gpg --import canon-pub.asc
gpg --fingerprint            # compare with the canon
gpg --verify mirrors.json.sig mirrors.json

What a signature catches that your eyes miss

If you can only do one check, do this one. A page that cannot produce a matching signature has failed, however polished it looks.

The Torzon PGP key: where it comes from and how to keep it

Every claim on this page depends on one thing: getting the Torzon PGP public key from a source you have independently reasoned about, not just the first result a search engine hands you. The key published on the Torzon canon is the one this whole reference is built around, and it is worth understanding where a key like that legitimately comes from before you trust it.

A key is generated once, then reused

A PGP keypair for a project like Torzon is typically generated once and reused for every signed release afterward — the address list, status updates, and any official announcement. That consistency is useful: if you have verified the Torzon fingerprint once against a source you trust, every future signature from the same key inherits that trust, without you needing to re-verify from scratch each time.

Keep your own copy, not just a bookmark

Bookmarking this Torzon reference page is not the same as keeping the key. Browsers get compromised, bookmarks get hijacked by malware that silently edits saved URLs, and a page can be cached in a state that predates a key rotation. Import the Torzon public key into your own keyring with gpg --import so the verification step works even if you cannot reach this page at all.

What a key rotation looks like, and why it matters

Occasionally a project rotates its signing key — after a suspected compromise, a long gap in operations, or simply good hygiene. A legitimate Torzon key rotation is itself announced and signed by the outgoing key where possible, creating a chain you can follow. A sudden, unexplained "new official key" posted only on a forum, with no link back to the previous Torzon key, is a strong clone signal rather than a routine update.

Common PGP verification mistakes on Torzon

Most Torzon phishing incidents that involve a PGP step at all do not happen because the math failed — they happen because a shortcut was taken somewhere in the process. The mistakes below account for the overwhelming majority of failed verifications reported around Torzon and similar markets.

Trusting a fingerprint pasted in chat

A fingerprint copied into a Telegram or Discord message from someone claiming to represent Torzon is not verification — it is a claim about verification. Get the fingerprint from the signed canon itself, not from a third party repeating it, however confident they sound.

Skipping the character-by-character compare

It is tempting to glance at a fingerprint, see that it "looks right," and move on. A single swapped character in a 40-character hex string is invisible at a glance and catastrophic if missed — it means you imported an attacker's key instead of the real Torzon key. Compare it in full, ideally by copying both strings into a text tool rather than eyeballing them.

Verifying the key but not the file

Importing the correct Torzon key is only half the job. You still need to run gpg --verify against the specific file or address list you intend to trust. A correctly imported key sitting unused in your keyring protects nothing on its own.

Assuming a matching layout means a matching key

A cloned Torzon page can reproduce the entire visual verification instructions, including screenshots of a correct-looking fingerprint. Never treat the instructions on a page as proof of anything about that same page — only an independent gpg --verify run on your own machine, against a key you sourced carefully, counts.

Quick verification checklist for the Torzon PGP key

Before opening any Torzon onion address, run through this short checklist. It takes under a minute and covers everything this page has walked through in detail.

1. Import the Torzon public key from this canon, not from a forum or chat message.
2. Compare the full Torzon fingerprint character by character — never a partial glance.
3. Run gpg --verify against the signed Torzon address list, not just the key.
4. Confirm the result says Good, with no substituted or expired Torzon key warning.
5. Only then copy the verified Torzon onion address and open it in Tor Browser.

Skipping any single step in this Torzon checklist reintroduces the exact risk PGP exists to remove. Treat it as all five steps or none.

What it means when a Torzon PGP key rotates

A signing key can be rotated for the same reasons an onion address is: suspected compromise, routine hygiene, or an operator simply moving to a stronger key. A rotation on its own is not a red flag, but it changes what "verify" means for a short window — the old key can no longer vouch for new material, and the new key has not yet built the track record the old one had. The signed transition itself is what matters: a legitimate rotation is announced and signed by the outgoing key before the incoming key takes over, creating an unbroken chain a reader can follow. A rotation that simply appears with no prior announcement, or where a new key claims authority without the old key's endorsement, is the pattern a phishing operation would produce if it were trying to insert its own key into the trust chain.