PGP key
This is the desk key. It signs every mirror notice, every release note and every dispute ruling the market issues. If a document claims to come from us and does not verify against this fingerprint, it is not from us — no matter how good the typography is or how plausible the onion it points at looks.
Use it in the other direction too. Paste your own public key at registration and rulings on your orders are encrypted to it, so the reasoning behind a split is readable by you and nobody else.
- Fingerprint
-
E5AE A7AC 3A7F 16D2 DA93 6302 5D1F BCFC 2F36 FFD1 - uid
ShadowVendor (market pgp)-
[email protected] - Algorithm
ed25519- Created
2026-11-02- Caps
[SC]
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEauooZhYJKwYBBAHaRw8BAQdAgl83dWHLHn+7hr3rf/Ul7Nh4MlnXDJY4f0Dm CLLHNN60PlNoYWRvd1ZlbmRvciAobWFya2V0IHBncCkgPFNoYWRvd3ZhdWx0LkZp bmVzdF9wbHVnYWRtaW5AcG0ubWU+iJAEExYKADgWIQTlrqesOn8W0tqTYwJdH7z8 Lzb/0QUCauooZgIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRBdH7z8Lzb/ 0TBSAP98tW+xp3+81KfejXSjSamdkBTt/69m2BHWF7o4EfLjJgD+PZesVj7OZ+b3 ZBs+83Bk7JwhGlJ8y/UHqYVA2yWfJg8= =+2is -----END PGP PUBLIC KEY BLOCK-----
Verify the fingerprint out-of-band before you trust it — from a signed canary on a mirror you already trust, or from a key you imported at your first visit. A key block fetched from the same host it is supposed to authenticate proves nothing on its own. Check it against the canary page.