>> KEY MANAGEMENT

  • [SUBKEYS] Use subkeys for signing/encryption, keep master key offline
  • [EXPIRATION] Set key expiration (1-2 years), extend as needed
  • [REVOCATION] Generate revocation certificate, store safely
  • [BACKUP] Encrypted backup of keys on offline storage

>> SIGNING MESSAGES

Sign messages to prove authenticity. Vendors often sign product updates:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

This message is signed by me.
Verify with my public key.

-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE...
-----END PGP SIGNATURE-----

>> VERIFYING SIGNATURES

Always verify TorZon announcements and mirror lists:

  • [1] Import official TorZon PGP key
  • [2] Copy signed message
  • [3] Verify in GPG: gpg --verify message.txt
  • [4] Check "Good signature" and correct fingerprint

>> COMMAND LINE TIPS

# Generate key
gpg --full-generate-key

# Import vendor key
gpg --import vendor.asc

# Encrypt message
gpg --encrypt --armor -r vendor@key message.txt

# Decrypt message
gpg --decrypt message.asc

# List keys
gpg --list-keys