PGP without the headache

PGP is the part of the market that people dread and the part that protects them most, and the dread comes from treating it like a theory when it is really five commands. This guide is the five commands, in the order you will use them, with no more abstraction than the task needs.

Generate your key

Run the generator once, on a machine you trust, and it produces a public key and a private key. The public one you share freely, the private one you guard like a password. The generator asks a few questions, a name, an email, a size, and the size should be the largest sensible option, because the key is meant to outlast the devices you use it on. When it is done you have two files, and the private one is the one to back up, because losing the public key is an annoyance and losing the private one is a lockout.

Import the market's key

Take the market's public key from a source you trust and import it into the same keyring. Then check the fingerprint, the short string that identifies the key, against the one the market publishes in a place you already trust. The fingerprint check is the whole point of the import, because importing a key is easy and importing the right one is the skill. Once the fingerprint matches, the key is yours to verify against, and every message it signs is a message you can trust came from the market and not from someone wearing the market's face.

Sign a test message

Before you rely on the setup, send a test. Write a short message, sign it with your private key, and verify the signature with your public key. If the verifier says the signature is good, the whole chain works, generation, import, signing, verifying, and you have proved it to yourself in two minutes. The test is worth doing because the alternative is discovering a broken setup at the worst possible moment, the moment you need a signature to mean something and it does not. Five commands, one test, and the part of the market you were dreading is the part you now control.