How to Verify an Onion Address With PGP

PGP verification is the strongest check available, and it is also the one most people skip because it looks like work. It is not much work, and it is the difference between trusting a claim and checking a fact. The idea is that the market’s operator signs its mirror list with a private key, and anyone with the matching public key can confirm the list has not been changed. A fake mirror cannot produce a valid signature, because it does not have the private key.

The steps, in order. First, get the operator’s public key from a source you trust, ideally one you reached independently of the market itself, and import it. Second, fetch the signed mirror message, which is the list of current addresses with a signature attached. Third, verify the signature against the key you imported. If it checks out, every address in that list is real and every address not in it is a claim you should not trust. If it does not check out, do not use any of the addresses on that page.

Getting the key

The part that trips people up is the first step, getting the key. A key you download from the same page as the message it is supposed to verify is not independent, because a fake could ship both. The key has to come from somewhere you reached without going through the market: a forum you trust, a key you saved the first time, or a second person who has it. Once you have a key you trust, every check after it is fast, because you are comparing a signature, not guessing.

You do not have to do all of this on every visit. The realistic rhythm is to verify the key and the list when you first reach a market and whenever the address set changes, and in between to use the simpler address-bar check. The PGP check is the anchor. The address-bar check is the daily habit. Together they cover the two failure modes, a list that has been swapped and an address that has been rotated.