Pin a fingerprint once
The step people skip because it produces nothing visible at the time, and the one every other habit rests on.
Why the fingerprint and not the key
A key is a large blob you cannot meaningfully inspect. A fingerprint is a short hash of it, short enough to compare by eye and long enough that nobody can produce a second key matching it. You pin the fingerprint and treat key files as disposable.
That reverses the usual instinct, which is to save the key file somewhere safe. The file needs no protection at all. It is public and can be fetched from anywhere including somewhere hostile, then checked against the fingerprint you hold. Only the fingerprint has to be right.
What counts as independent
| Source | Independent? |
|---|---|
| Different operators, different infrastructure | Yes. Rare in this space and worth seeking out. |
| Several sites run by one person | No, and this is very common and rarely disclosed. |
| Several sites that copied a fourth | No. Aggregation is the default here. |
| The same value in captures across years | Weakly. Persistence is harder to fake retroactively than a page is to edit now. |
Doing it
- Collect it from several genuinely independent places.
- Compare in full. The whole string, character by character, not the first four and last four, which is the check a forger designs around.
- Write it down somewhere you control. Paper is genuinely good, because nothing running on your machine can edit it.
- If they disagree, stop and wait. At least one source is wrong or compromised and you cannot tell which from where you are standing.
Afterwards
Nothing. That is the point. Every check from then on is mechanical and takes under a minute, and you never repeat this step unless the key genuinely changes, which is rare and deserves the treatment described in the key rotation forger. The reason people skip this step is that it produces no visible result at the time. The payoff arrives later, on an evening when something looks completely normal and is not.