A good signature from the wrong key
The output says good. The maths is genuinely fine. And the right response is to close the tab, which is why this specimen catches people who have been checking signatures for years.
- What it is
- A valid signature made by a key you never agreed to trust
- Where you meet it
- Any page that publishes its own key alongside its own block
- What it settles
- That somebody signed it. Not that it was them
- Cannot tell you
- Anything reassuring, despite containing the word good
The specimen
gpg: using RSA key 9F3C 22A1 D084 7E56 B1C9 0ED7 3355 AA82 61F0 9DBB
gpg: Good signature from "Torzon Market <…>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature.
your pinned fingerprint: 4A2F 91C7 0E5B 66D8 3F1A 9C40 77BE 2D15 A8E3 04FB
A pass that is not a pass. Lime is the line people read. Salmon is the key that actually signed, and it is not the one on the last line. Both fingerprints here are invented for the illustration.
Why this reads as success
Because the word good is doing the work, and it is placed on the line a person scans. The output is telling the exact truth: the signature is valid for the key that made it. What the tool cannot know is that this is not the key you meant, because you never told it which key you meant.
The line underneath usually spells out that the key is not certified, and it gets read as boilerplate, because most warnings in most software are boilerplate.
How you end up here
- You imported the key from the page you were checking. The most common route by a distance, and it turns the whole exercise into a page confirming itself.
- You imported it a long time ago and forgot which one it was. Two keys in a keyring and no note about where either came from.
- The name matched. The user id in a key is free text. Anybody can put anything there, including the exact name of a market.
- You pulled it off a keyserver by name. Keyservers accept uploads from anyone and match on strings, not on identity.
The habit that catches it
Read the key line before the good line, and compare it against the fingerprint you wrote down. Two seconds, once you have made yourself do it in that order. Almost everybody who gets caught by this specimen has the correct fingerprint written down somewhere and did not look at it, because the output already said the reassuring word.
- Find the line naming the key that signed. It is above the result, not below.
- Compare it to your pinned value, in full. Not the first group and the last group.
- If it does not match, stop. There is no version of this where a different key is fine because everything else looked right.