PGP / GPG

PGP (Pretty Good Privacy) is the original public-key encryption and signing program created by Phil Zimmermann in 1991, and GPG (GNU Privacy Guard, or GnuPG) is the free, open-source implementation of the same OpenPGP standard that most people actually run today. Both let you encrypt files and email, attach digital signatures that prove authorship and integrity, and verify signatures and checksums published by software projects. For a miner or node runner, that last use is the everyday one: before you flash firmware onto a machine that controls real money, you verify that the bytes you downloaded are the bytes the developers signed.

What the standard covers

The interoperable format underneath these tools is OpenPGP, specified most recently in RFC 9580 (2024), which replaces the older RFC 4880 and mandates modern algorithms such as Curve25519 and Ed25519. OpenPGP provides encryption with public-key or symmetric algorithms, digital signatures, compression, and key management — the full toolkit for confidential and authenticated communication outside any single vendor. The mechanics mirror what Bitcoiners already understand from wallets: you hold a private key that signs and decrypts, and you publish a public key that anyone can use to verify your signatures or encrypt messages to you. Losing the private key means losing the identity, so serious users back up their keyring with the same discipline they apply to a seed phrase.

The trust model

PGP does not rely on certificate authorities. Instead it pioneered the web of trust, where users sign each other's keys to vouch for the binding between a key and its owner — a decentralized alternative to the centralized certificate hierarchy used by websites. In practice, most verification today is simpler: a project publishes its signing key fingerprint in multiple independent places (its website, its repository, prior releases), and you check that the key that signed a release matches that fingerprint. The fingerprint check is the whole game; a valid signature from the wrong key proves nothing.

Verifying a release on the bench

The routine worth building into muscle memory looks like this: download the release, its checksum file, and the detached signature; verify the signature over the checksum file with gpg --verify; then confirm the download's hash matches the signed checksum. Bitcoin Core, most wallet software, and open mining firmware ship exactly this trio. Skipping it means trusting whatever server or mirror handed you the file — the same misplaced trust that supply-chain attacks exploit. Verification before SD card flashing or any firmware install is the sovereign habit: it costs a minute and removes an entire class of attack.

Key hygiene

A signing identity deserves the same operational care as a wallet. Generate keys with an expiry date so a forgotten key ages out instead of lingering forever; use subkeys for day-to-day signing and encryption while the primary key stays offline; and keep a revocation certificate stored separately, so a compromised key can be publicly disowned. Hardware tokens can hold GPG keys so the secret never touches the laptop's disk — the same air-gap instinct that keeps signing keys off internet-connected machines. And publish your fingerprint in more than one place you control, because redundancy is what makes it verifiable.

For a sovereign Bitcoiner, the practical payoff of PGP/GPG is the ability to verify exactly who signed a release and that the bytes were not tampered with, independent of any platform, app store, or certificate authority. It is one more layer of trust you can bring in-house instead of renting. Related tooling we cover includes minisign and signify for lighter-weight signing with fewer moving parts, and reproducible builds for verifying that a signed binary truly matches its published source code.