4096-bit RSA · the key the market signs with
The public PGP key
Every announcement, mirror rotation, and support reply from the market is signed with this key. If you can verify a signature against it, you know the message came from the market and not from someone wearing its face. This page is the key, the fingerprint, and the five-minute routine to check it.
On this page
The key
The key below is the market's public key. Import it into your keyring, and you can verify any message the market signs. The key is a 4096-bit RSA key, which is the largest size most people bother with, and it is set to expire in three years, which is long enough to outlast the devices you will use it on and short enough that the market has to recommit to it on a schedule. Import it from a source you trust, and then check the fingerprint, because importing a key is easy and importing the right one is the skill.
-----BEGIN PGP PUBLIC KEY BLOCK----- mQINBGrRfgYBEADLzewQSWoxvS3wRrY/XM81rSePUcevr717QPV61o1nvwzu+FHX drL1sLBdrWAAYUpX+qLnflAccY3V3sjkOEONIKK7Gvoy10MABtpp97jDETJYd3Mw MAJCP9cfgUFxjdnyYXYJCT07CY1bPOZ7HrfC5cpyr9UQL8fELgOCj2YsByGEX1Mo F2DRiKj+UqEUfmGEOIXokw/ftgtkxheEiu8Poo4zMzWfqIDvcfAfZotmfJFnbKOq 9DHWhZlgsxtBOx5XrTr81coMGuPGnHPj7mZeJQbeD7IQhM0zjDSc4SjUx270agYV kNsGLrj/dtzjQ/jaMGLuX0JMK5squPo3/GptWeGxmPace0Gdb4g7yg+VkU5445IT XP2i7gez3z1ns9BP8PkizrhjGWhtDmZbBEOTMxjuGB70BZ+LHwke9wGOE7oyKZJh pt3/RclXwjGYY/8+z6AGifCTjyYQzH7UZjKTrA5F30zPteu2E7u7QeVIqRAHgS1W Xs1VqbFLZo8jBnd4UQjHx+ycEM6yKolQhfsVuUSiQJeNAja9axHE7SIX77lBu9lc loyFIzBIXvMTZfVrQAKryWEm1B+oWrsx8Xk79iVzVpsmAzaiYRt4wZUQjFqE4gCV 5WojfsTGKENQLBuIbdGEF/9nkse3RdW8LRYi5yAVQLTS2njeU7OMBCqq4QARAQAB tCpCbGFja09wcyBNYXJrZXQgPGFkbWluQGJsYWNrb3BzbWFya2V0LmJpej6JAlcE EwEKAEEWIQR+C5Zo7TYIVpGE/cobXwLVx0zICQUCatF+BgIbDQUJBaOagAULCQgH AgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRAbXwLVx0zICe/UD/4/VcWkZmePj3et 17ZZ7ajnxJCmuR1/4vn+zqP4SlPnrjVfsu3v61oczMSJXoWeaR9bsWY+naaIoBbP iuvmNpNBI4tCzMwwnBihj/1vbFP2S6Q7MyBXSTv4O1yH6HtEXXt0oqcN6GSq2yZh eqOtYe0XZz+yP/WkhiVDcb+8orMW51LQbG4p9x9QYw3aSjAGt04ALWWfOPu/GwSl SpImlXsNgWFVIeO5Jt23idy4XXWiUZQjwO/cHY6f91z0xM5WFkgEHzRUeIrUxzgu /dmakcWQvG4Di/JGPYEizXntnbnnhcFYyASvdpKdY3p2C214MPFQHs3SedXDhzy8 u8EbMFsUWofzmO79cQ1qNvm1hQEQx/0mpaXi37Kl7cTDP8qp7Oiz/ChsXczrgAeg 3rkdLgexnhdXmoMoEc/UDUA/m2DqeCeDvOkRG6PHBX9C3az/3icVHmq60omoebQp iXKDFjB1HFPQuOFvT925Ij43XsSvz7LiJ/R8nsVVznY8gbqADj5XwNo1Iyd4eLJd ucY9gBPfiaC5ev8qyMxBWGxP/VsWRGM6RH5DrVeLR2kWus2P/nS0U3CwwjBgSSi2 Lv14I1OpIPIz5XAh78Zc+KFGVit/aGimKlLmO+wneSLpkroSWoJq9LhsiEGLT7kI HFuCHTKsZcHWUEp65AxkNIlkEj2r2w== =+zdD -----END PGP PUBLIC KEY BLOCK-----
The fingerprint
The fingerprint is the short string that identifies the key, and it is the thing you match against a source you already trust before you start relying on the key itself. The full fingerprint for this key is:
7E0B 9668 ED36 0856 9184 FDCA 1B5F 02D5 C74C C809
When you import the key, your tool will show you a fingerprint. Hold it against the one above, group by group, and if they match, the key you have is the key the market says it is. If they do not match, you have the wrong key, and the wrong key is worse than no key, because it will happily verify the wrong messages. The fingerprint check is the whole point of the import, and it takes ten seconds, so do not skip it because the import already felt like it worked.
The five-minute check
Once the key is imported and the fingerprint matches, verifying a signed message is a single command. Take the signed message, run it through your verifier, and the tool will tell you whether the signature is good. A good signature means the message was signed by the holder of the private key that pairs with this public key, which is the market. A bad signature means either the message was tampered with or it was signed by a different key, and in both cases the message is not what it claims to be. The check is not a guess, it is a computation, and the computation either passes or it does not, which is exactly the kind of certainty the rest of the clearnet does not offer you.
Where to get it
Get the key from a source you already trust, and not from the message that is trying to convince you to trust it. The bootstrap problem is that the first key you import has to come from somewhere, and the somewhere has to be a place you have independent reason to believe in. For most people that is a source they have used before, a forum they trust, a friend who has already verified it, or the market's own signed announcement from a previous, already-trusted key. The key on this page is the same key, and this page is one such source, but the habit is to confirm it against a second source before you build anything on top of it, because the first import is the one that has to be right, and the second one is the one that proves the first one was.