Verify on arrival
The single highest value habit on this site. Everything else is either supporting it or covering what it cannot reach.
Before you start
You need a fingerprint established independently and stored somewhere you control. Without it this check is theatre, because a signature verified against a key taken from the page being checked proves nothing at all. See pinning a fingerprint, which is done once.
The procedure
- Find the signed block. It begins and ends with the armour lines. If there is no signed block, you are finished and the answer is no.
- Copy all of it. Nothing trimmed, no whitespace altered, no quotation marks converted. A partial copy fails identically to tampering, which causes a lot of unnecessary alarm.
- Verify against your pinned key. Not one the page offers, not one you fetched because verification complained.
- Read the output. Both the key identifier and the date inside the signed text. This is the step people skip and where the two dangerous outcomes live.
The four outcomes
| Result | Meaning | Do |
|---|---|---|
| BAD signature | Text altered after signing, or the signature fabricated | Leave. Unambiguous, no judgement required. |
| No public key | Signed by a key you do not hold. A gap in your keyring, not a verdict. | Import the correct key after checking its fingerprint. Never one the page hands you. |
| GOOD, unexpected key | The maths works against a key that is not yours | Leave. The word GOOD appears, which is why this catches people. |
| GOOD, old date | Verifies perfectly, statement is months old | Treat as unconfirmed. Signatures never expire, so genuine old ones get replayed. |
Why the date is inside the signature
A signature has no expiry. A statement signed two years ago verifies exactly as cleanly today, which makes signatures excellent for archives and awkward for anything about the present. Putting the timestamp inside the signed text fixes it, because the date cannot then be changed without breaking the signature. An attacker replaying an old statement is stuck presenting an old date, and the only remaining question is whether you look.
What it cannot do
It says nothing about whether the signer is honest, nothing about whether your own machine is trustworthy, and nothing about what happens after you log in. It answers one question completely, which is whether you are where you think you are, and nothing else available to you answers it at all. That narrowness is why it is worth doing and why the other five habits exist.