The key
The step people skip because it produces nothing visible, and the one everything else on this site depends on.
Why the fingerprint and not the key file
A key is a large blob you cannot meaningfully inspect. A fingerprint is a short hash of it, short enough to compare by eye and long enough that nobody can produce a second key matching it. You pin the fingerprint and treat key files as disposable.
That reverses the usual instinct, which is to carefully save the key somewhere safe. The file needs no protection at all. It is public and you can fetch it from anywhere, including somewhere hostile, then check it against the fingerprint you hold. Only the fingerprint has to be right.
Establishing it
- Collect it from several places. Independent means they would have to be compromised separately, so three pages by one operator count as one source, and three sites that copied a fourth also count as one.
- Compare in full. The whole string, character by character. Not the first four and last four, which is the check a forger designs around.
- If they agree, write it down somewhere you control. Paper is genuinely good, because it cannot be edited by anything running on your machine.
- If they disagree, stop and wait. At least one source is wrong and you cannot tell which from where you are standing. This is not a majority vote.
The four outcomes
| Result | Meaning | Do |
|---|---|---|
| BAD signature | The maths fails. Text altered or signature fabricated. | Leave. No judgement required. |
| No public key | Signed by a key you do not hold. A gap in your keyring. | Import the right key after checking its fingerprint, never one the page offers. |
| GOOD, unexpected key | Maths works, against a key that is not yours. | Leave. The word GOOD appears, which is why this catches people. |
| GOOD, old date | Verifies, but the statement is months old. | Treat as unconfirmed. Signatures never expire, so old genuine ones get replayed. |
The last two are what catch experienced users, and one habit defeats both. Read which key signed and when, rather than pattern matching on the word GOOD. Two seconds.
What it does not tell you
That the signer is honest, that your own machine is trustworthy, or anything about what happens after you log in. It answers one question completely, which is whether you are where you think you are, and no other tool available to you answers it at all. That narrowness is why it is worth doing and why it is not a substitute for anything else.