PGP verification · trust the key · 2026

Verify WeTheNorth with PGP

A PGP check is the one test a clone cannot pass. The look of a page copies easily. A valid signature from the canon key does not. Here is how to import that key, check the signature that ships beside the mirror register, and read the fingerprint. Do that, and the address you finally open is the real WeTheNorth, not a look-alike dressed up to match.

Canon pointerThis page is the method, not the source. The public key, the signed directory, and the address you test all sit on the canon. Bring the key here and run the check against what the register publishes.hn2paw7hljeihrk7qm2toniay5bb4cfz46cav5iywnsv64klm45mypqd.onion

The checkthree moves

How a WeTheNorth signature check runs

The idea is small once you see it. You hold a key. The register ships with a signature made by the matching private key. The check asks one question. Was this exact list signed by the key you trust? Nothing about the wording of a page enters into it.

Import the keyYou add the canon public key to your keyring once. From then on it is the yardstick every address is measured against.

Check the signatureYou run the signature file against the register. A pass means the list came from the key, untouched.

Match the fingerprintYou compare the fingerprint the tool prints with the one on the canon. Same string, same key, same trust.

Key over name

What PGP proves that a careful eye cannot

People try to judge a link by reading it. They count characters, they squint at the middle of the string, they trust a page that looks polished. A patient clone defeats all of that. It can copy the layout, the wording, and most of the address.

A signature closes that gap. The private key that signs the register never leaves the people who hold it. No clone can produce a list that passes the check without that key. So you stop grading the name and start reading the math. The name can lie. The signature cannot.

Run itstart to match

Run the check, from import to match

Import the canon public key once. Keep the file you imported so you can compare its fingerprint later.
Pull the signed register and the signature that sits next to it. Both come from the canon, not from search.
Run the verify command on the pair. The tool reads the signature and the file together.
Read the result. A good signature names the canon key by its fingerprint. A bad or missing one means stop.
Compare that fingerprint against the one shown on the canon. If a single block differs, the list is not ours.

gpg --import wethenorth-canon.asc
gpg --verify mirrors.json.sig mirrors.json
gpg --fingerprint wethenorth-canon

Honest limit. The key that signs the register publishes in Phase 0. Until it does, the fingerprint reads pending and the strongest check you have is a slow, full character compare against the canon.

Warrant canaryextra signal

Where a warrant canary fits in

A warrant canary is a short signed note that gets refreshed on a set schedule. As long as it keeps appearing, signed by the same key, it quietly says nothing has forced a change behind the scenes. If it goes stale or vanishes, that silence is the message.

The canary rides on the same key as the register, so the moment you can verify one you can verify the other. It is pending alongside the key in Phase 0, listed here so you know to look for it.

Questionsplain answers

Verification questions people ask

I have never used PGP. Is this too much?

No. You import one key, run one command, and read one line of output. The first run takes a few minutes. Every run after that is quick, and it is the only check a clone cannot fake.

The signature check failed. What does that mean?

It means the list was not signed by the canon key, or it was changed after signing. Either way you do not use any address from it. Close the page and start again from the canon.

Is the fingerprint the same thing as the onion address?

No. The onion address is where the market lives. The fingerprint identifies the key that vouches for that address. You check the fingerprint so you can trust the address.

Next moves

Key checked and ready to connect? The access guide puts this step inside the full run over Tor.

Read the safety notes