PGP Verification — Mirror List Authentication

Pretty Good Privacy (PGP) signatures provide mathematical proof that a published onion hostname list originated from the holder of a private key. This article documents the verification workflow analysts use before citing DrugHub endpoints in research — independent of any clearnet domain branding.

Key fingerprint

The connectivity reference publishes this fingerprint for mirror-list signing keys:

Compare character-by-character after import. A single hex mismatch indicates wrong key or tampered export.

Importing the key

1. Install GnuPG (Gpg4win/Kleopatra on Windows, GPG Suite on macOS, gnupg package on Linux).
2. Fetch the public key from a keyserver using the fingerprint, or import a .asc file from a trusted offline source.
3. Mark the key as ultimately trusted only after out-of-band fingerprint confirmation.

Verifying signatures

Detached signature files (e.g. mirrors.asc) accompany hostname lists. Run:

Expected output includes Good signature from the key matching the fingerprint above. If verification fails, discard the hostname list — do not connect or cite those strings.

Failure modes

• Wrong key imported. Similar filenames on paste sites; always verify fingerprint.
• Expired subkey. Check key rotation notes on the Security page.
• Cleartext list without signature. Unsigned lists are documentation-only; treat as unverified.

See also

• Security overview
• Mirrors
• Glossary: PGP verification