Chapter 2 of 6 / is this the real one
The check said good and I am still unsure
The output says good, the maths is genuinely fine, and closing the tab is still the right move. This one catches people who have been checking signatures for years, which makes it the most expensive page in the chapter.
What the output is actually telling you
That the signature is valid for the key that made it. That is the exact truth and it is not the question you asked. The tool has no way to know which key you meant, because you never told it, so it reports success against whatever key it found.
Underneath there is usually a line saying the key is not certified, and it gets read as boilerplate, because most warnings in most software are boilerplate.
How people end up here
| Route | How often | Why it fails |
|---|---|---|
| Imported the key from the page being checked | Very common | That turns the whole exercise into a page confirming itself |
| Imported it long ago and forgot which one it was | Common | Two keys in a keyring and no note about either |
| The name on the key matched | Common | A key user id is free text. Anybody can type anything in it |
| Pulled it off a keyserver by name | Occasional | Keyservers accept uploads from anyone and match on strings |
The name is not a check
The name inside a key is not verified by anything at all. Treating a matching name as confirmation is the same error as treating a matching address prefix as confirmation, and it fails for the same reason.
The habit that catches it
- Find the line naming the key that signed. It sits above the result, not below it.
- Compare it against your pinned fingerprint, in full. Not the first group and the last group.
- If it does not match, stop. There is no version of this where a different key is acceptable because everything else looked right.
Almost everybody caught by this has the correct fingerprint written down somewhere and did not look at it, because the output had already said the reassuring word.
What to do if it does not match
- Do not log in to find out more. Whatever you would learn costs you the credentials.
- Do not import the offered key to make the warning go away. That is the failure, not the fix.
- Do check whether the announcement appears anywhere else, signed by the key you do hold.
- Do treat a key change with a deadline attached as an assertion, not an announcement. Genuine ones are signed by the old key, appear in several places, and overlap for a long time.
Keeping a keyring you can actually reason about
- Keep as few keys as possible. Two keys and no notes is how this page happens.
- Write down where each one came from and when, in the same file as the fingerprint.
- Never import a key from the page you are about to check with it. That is the whole failure in one sentence.
- Recheck the fingerprint against your own file rather than against the keyring, because the keyring is the thing that might be wrong.