How to verify a Tor onion address with a PGP signature

What you are verifying

Every serious Tor market publishes a PGP public key on day one and uses it forever after. When they rotate an onion address or announce a mirror, they sign the announcement with that same private key. If the signature checks out against the same public key you already have, the announcement really came from the market. If it does not, someone is trying to send you to a fake site.

The whole point is that the operator can sign a new address from anywhere on the planet and anyone can verify it without trusting a forum, a directory or a URL shortener. You only ever need to trust the first key you got.

Get the public key once

Find the market's PGP key on the source you already trust the most. That is usually the /pgp page on their current onion, their post pinned on Dread, or the key linked from a directory that has been around long enough to be worth trusting.

Copy the whole block from -----BEGIN PGP PUBLIC KEY BLOCK----- to -----END PGP PUBLIC KEY BLOCK----- into a text file called something like market.asc.

Import it into your PGP tool.

gpg --import market.asc

Kleopatra users open the file and click import. Whatever you use, once the key is in your keyring you never need to fetch it again for that market.

Copy the signed announcement

Copy the whole signed message from the source that shows it. It looks like this.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

The new main address of Market is
newaddressxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxid.onion
Rotated on 2026-06-30.
-----BEGIN PGP SIGNATURE-----
...signature bytes...
-----END PGP SIGNATURE-----

Save the whole block to a file called announce.txt including the headers. Do not strip the blank line after Hash: SHA512. The signature covers every byte and even a stray space breaks the check.

Verify

gpg --verify announce.txt

You want to see this.

gpg: Good signature from "Market <[email protected]>"

The line after may warn This key is not certified with a trusted signature. That warning is normal. It only means you have not personally signed the key. What matters is Good signature. If the signature is bad or missing you see BAD signature or Can't check signature: No public key. Either way, do not use the address in the message.

Kleopatra path (Windows and KDE)

Import the public key the same way (file, drag into Kleopatra, or File → Import). Save the signed announcement as announce.txt. Right click it in the file manager and pick More GpgEX options → Verify. A window pops up saying either the signature is valid or the file has been modified. Same principle, different button.

Common mistakes

Copying only the address without the signature block above and below. The verifier cannot run without the whole envelope.

Fetching the public key from the same page that lists the new address. If both live on a phishing site, both match, and the check passes with a fake key. Always get the key from a source you already trust and keep it.

Trusting a signature from a different key ID than the one you have. Every check must be against the same fingerprint you saved the first time. Kleopatra shows the fingerprint under the signer name, GPG prints it with --verify. Compare it letter by letter to the one you saved.

Once, then never again

You do this once per market. After that every future rotation, mirror or announcement gets verified against the key you already have. No forum, no directory and no chat handle can push a fake address on you.