S2 · PGP & the canary — The door is a fingerprint

The door is the fingerprint of the key that signs our warrant canary. Don’t take our word for it: verify it yourself.

Fetch our public key (/onsecret-pgp.asc), import it, then verify the canary’s signature with gpg. A valid signature by the expected key — that is the whole game. Then read the signing key’s full fingerprint (40 hex characters), no spaces, case-insensitive.

Canary-verification tip (taught in the open on /canary): a valid signature is not enough — a canary only protects you if you notice it is fresh and on-cadence.

Run this:

curl -sO https://onsecret.net/onsecret-pgp.asc
gpg --show-keys --with-fingerprint onsecret-pgp.asc
# then verify the canary block from /canary:
#   gpg --verify canary.asc