PGP and signatures: why a signed address list beats a link you were sent
PGP is the tool that lets a reader tell a genuine address list from a tampered one. You do not need to master the mathematics to benefit from it, and this page keeps to the part that changes your odds.
The one idea that matters
A signature ties a message to a key. If a project signs its address list with a key you already trust, then any change to that list — even one character in one address — breaks the signature. You do not have to trust the web page that hosts the list; you only have to trust the key and check the signature. That is the whole benefit, and it is a large one.
What signing does not do
It does not tell you the market behind an address is honest. It does not encrypt your traffic or hide who you are. It proves one narrow, valuable thing: that the list you are reading is the one the key-holder signed, unaltered. Keep that scope in mind and PGP becomes a precise tool rather than a magic word.
Getting the key from more than one place
A signature is only as trustworthy as the key you check it against. If you fetch both the list and the key from the same page, an attacker who controls that page can swap both. So the habit that matters is cross-channel: confirm the key's fingerprint from at least two independent places before you rely on it. After that, verifying a signed list is quick and repeatable. Software such as GnuPG, the free reference implementation of the OpenPGP standard, handles the actual cryptographic check once you have the right key.
How to check a PGP signature against a darknet market address list
The mechanics are the same whether you are checking Deep Web Wire's own eventual signed list or a project's own signed announcement. This is the sequence, spelled out as steps rather than prose.
Step 1 — Obtain the public key from two independent channels
Never from one page alone
Fetch the signer's public key from at least two sources that do not depend on each other — for example, a project's own site and a separately maintained keyserver or forum post — before trusting it for anything.
Step 2 — Compare the fingerprint, not just the key ID
A short key ID can be spoofed
A full fingerprint is long enough to make a deliberate collision impractical; a short key ID is not. Always compare the full fingerprint string across your independent sources.
Step 3 — Run the signature check with dedicated software
Let the tool do the math
Import the verified key into software such as GnuPG and let it verify the signed file mathematically — do not attempt to eyeball a signature block as proof of anything.
Step 4 — Treat a failed check as a hard stop
No exceptions for a "probably fine" failure
A signature that fails to verify means the file does not match what the key holder actually signed — full stop, regardless of how convincing the darknet market onion address inside it looks. See the Electronic Frontier Foundation for broader guidance on key verification hygiene.
For readers who just want the address
You can use this site without touching PGP at all: copy a string, cross-check it against a second trusted source, match it character by character, connect. Signatures simply make one of those sources far harder to poison. Start with the verify-before-you-deposit guide and add signing when you are ready.
Why we will not print a placeholder fingerprint
It would be easy to publish a plausible-looking string in the fingerprint slot today and swap it for a real one later, but a placeholder that resembles a genuine PGP fingerprint is actively dangerous — a reader who copies it and treats it as verified has been given false confidence, not a shortcut. An empty, honestly labeled "pending" slot cannot be mistaken for a check that has not actually happened.
What changes for readers once signing goes live
Once the signed list ships, this page will carry an actual fingerprint you can check independently against the offline signer keys, and the addresses across this wire will carry a machine-verifiable guarantee they do not yet have. Until then, the manual cross-check described above — comparing an address against a second independent source and matching it character by character — remains the load-bearing step, not a stopgap to skip.
How to think about signatures generally, even before ours is live
A PGP signature does not make an address trustworthy on its own; it makes a specific claim — "the holder of this key vouches for this exact string" — verifiable without you having to trust the page presenting it. That is a meaningfully stronger guarantee than an unsigned list, but it still depends on you actually knowing which key to trust in the first place, which is exactly what a page like this one is for.
A worked example of what a signature check actually catches
Say a phishing operator has cloned a market's page well enough to fool a casual visitor, and posts a look-alike onion address alongside a claimed PGP signature to look more credible. Without checking anything, that signature looks like exactly the kind of proof this guide describes. The check that catches it is not reading the signature block itself — it is verifying the public key against a source independent of the page making the claim, such as a previously confirmed fingerprint on this deepweb reference or the project's own long-standing channel. A signature verified against the wrong key, or against no independently sourced key at all, proves nothing regardless of how official the block of text around it looks.
Why the key itself, not the signature format, is the actual security boundary
A well-formed PGP signature block is trivial for anyone to produce with their own key — that is not the hard part, and it never was. The hard part, and the part that actually protects you, is knowing with confidence that a specific public key belongs to the operator you think it belongs to. That confidence has to come from somewhere other than the page you are currently reading, which is why this guide keeps repeating the same instruction: fetch the key from at least two sources that do not depend on each other.
How PGP fits with the rest of Deep Web Wire's verification chain
Signing is one layer among several this reference relies on, not a replacement for any of the others.
- The warrant canary proves Deep Web Wire itself has not been compelled to alter what it publishes — the layer beneath any individual signature.
- The mirror sourcing page explains the two-source cross-check every darknet market onion address goes through before a signature layer is even relevant.
- The verify-before-you-deposit guide covers the manual character-by-character check you should run regardless of whether a signature is available.
- The spot-a-fake-mirror guide covers the visual and structural tells a phishing page shows even before you get to checking any signature at all.
- The darknet market index and the status board are where the addresses this whole chain protects actually live.
Common PGP mistakes Deep Web Wire sees readers make
A signature check that is run incorrectly can feel just as reassuring as one run correctly — the software still prints a result. The difference is whether that result actually means what the reader assumes it means. A few mistakes account for most of the gap.
Trusting a key because it "looks" official
A key block has no inherent authority
Nothing about the visual formatting of a PGP public key block signals legitimacy — anyone can generate one, name it after any project, and post it anywhere. The key's authority comes entirely from being independently confirmed through more than one channel, never from how official the surrounding page looks.
Checking the signature but skipping the fingerprint comparison
"Valid" and "the right key" are different questions
Software will happily report a signature as cryptographically valid even when it was signed by an attacker's own key that has nothing to do with the real project. A valid signature only means something once you have separately confirmed the fingerprint belongs to the operator you think it does — skipping that step is the single most common way this check gets performed uselessly.
Re-using a key confirmation from months ago without re-checking
Keys get compromised and rotated too
A key that was genuinely confirmed six months ago is not automatically still the operator's key today — keys get rotated after a suspected compromise the same way onion addresses do. Treating an old confirmation as permanent is a smaller version of the same mistake as trusting a stale onion address without re-checking it.
Why this page doesn't recommend an easier shortcut
A reasonable question is why this Deep Web Wire page insists on fetching a key from two independent channels rather than just trusting whichever copy is easiest to find. The honest answer is that the easy version of this check provides none of its actual security benefit.
The security lives entirely in the independence of the second source
If both "independent" copies of a key trace back to the same page or the same person controlling both channels, comparing them proves nothing — it is the same failure mode Deep Web Wire's circular verification mistake, covered on the guides page, warns about. The extra effort of finding a genuinely separate channel is not bureaucratic caution; it is the entire mechanism that makes the check work at all.
What "independent" means in practice
Two channels count as independent when compromising one would not automatically compromise the other — a project's own site and a long-standing, separately-run forum account, for instance, rather than two pages hosted on the same server or linked from the same single source. This is the same standard the Deep Web Wire mirror list page applies to onion addresses, applied here to keys instead.
Frequently asked questions
- Do I need to understand cryptography to benefit from PGP here?
- No. You only need to trust the key and check the signature; the underlying mathematics does not have to be something you personally verify.
- Does a valid PGP signature mean the market is honest?
- No. A signature proves the list you're reading is the one the key-holder signed, unaltered. It says nothing about whether the market behind an address is trustworthy.
- Why hasn't Deep Web Wire published a signing fingerprint yet?
- We will not print a placeholder that could be mistaken for a real fingerprint. When the signed mirror list goes live, the fingerprint will appear here and be cross-posted for independent confirmation.
- What should I do to verify an address if I don't want to learn PGP at all?
- Copy the string, cross-check it against a second trusted source, and match it character by character before connecting. Signing simply makes one of those sources harder to poison.
- How does PGP relate to the darknet market onion addresses Deep Web Wire tracks?
- Deep Web Wire uses PGP to eventually let readers verify that a darknet market onion address list actually came from Deep Web Wire, unaltered. Deep Web Wire's onion address records and Deep Web Wire's PGP layer are two parts of the same verification chain.