What sits in this section
Five numbers live here and four of them are the same thing written down at different lengths. A key has a fingerprint. The fingerprint is a run of hex characters. You can quote all of it, half of it or a fifth of it, and those three choices are not equivalent, which is most of the argument this section makes.
The fifth number is a key size, and it appears as a warning rather than as a measurement. People rank keys by that figure and the ranking is close to meaningless. The 4096 page works through how a bigger number can sit on a weaker key.
None of this asks you to trust the site. Fingerprint lengths come from a published specification and the arithmetic is division. Where a judgement enters, the page names the assumption in its opening lines, under the rule set out on the counted and judged page.
The only section that answers ownership
Everything in the address section describes the format of a string. How long it is, which symbols it may contain, how many bytes hide behind the characters, how much compute buys a matching opening. All of that is equally true of a hostile address. A forger produces a string with the same length, the same alphabet and a perfectly valid checksum, because those properties belong to the encoding rather than to the owner.
A signature is different in kind. It is a statement that somebody holding a particular private key saw a particular piece of text. Nobody without that key can produce it. If the text is an address, and the key is one you tied to the market by some earlier and separate route, then a signature answers the question the address section cannot touch. Not what shape is this, but who wrote it down.
That is why the keys sit at the end of the site rather than the front. The address numbers are cheap and fast and they filter out accidents. The key numbers are slower and they filter out people. Read them in that order and the whole site reads as a sequence.
| What you want to know | An address check proves | A signature check proves |
|---|---|---|
| Is the string well formed | Yes. Length, alphabet and checksum all agree | Nothing. A signature has no opinion about encoding |
| Did it survive copying | Yes. Damage shows up as a hard failure | Yes, if the signed text carries the address inside it |
| Is it the same string I saw before | Yes, compared against a copy you stored | Yes, and it also says who put it there |
| Who produced it | Nothing at all | This is the only check that reaches the question |
| Is the destination honest | Nothing | Nothing. Authorship is not conduct |
Read the last row twice. A signature ties a message to a key. It does not make the holder of that key honest, careful or solvent. What it removes is substitution, where somebody stands between you and a source and swaps the address in transit. That attack is common and cheap. Everything after it is judgement and nobody can do that part for you.
The practical version fits on one line. Get a fingerprint from somewhere that is not the page you are checking, keep it, and compare against it every time after that. The forty page has the procedure and the ways people run it backwards.
Questions people ask
Do I need PGP at all?
Plenty of people never touch it. What they give up is the only check capable of saying that an address or a message came from the source they think it did. The forty page sets out what the check involves.
Which of these numbers should I quote?
The full 40 character fingerprint, every time. The 8 and 16 character forms are shorter for a reason that stopped being a good reason years ago.
Is key size worth comparing between vendors?
No. Size means something inside one algorithm and nothing across two, and even inside one the gap between common sizes is smaller than people assume. The 4096 page has the detail.