Group six of six
Words
A signature check answers one question and people hear a different one. Everything in this group lives in the gap between the question asked and the question the reader thought they were asking.
The one sentence the group is built on
A good signature proves that whoever holds a particular private key produced that exact text. It does not prove who they are, when they wrote it, or that they still mean it.
Read that sentence twice, because six of the seven pairs below are a consequence of it. The key is not a person. The text has no reliable date. The result is about bytes and nothing else.
None of that makes signatures useless. It makes them narrow. A narrow tool used for what it does is far better than a broad reassurance that turns out to mean nothing, and the difference between the two is the whole subject of this group.
The result is good. Whose key was it?
Words / Pair 35A good signature from the wrong key against A good signature from the right key
Verifying software reports the same result for both. Only the fingerprint says which key it used.
The test: Compare the fingerprint of the verifying key against one you already held
The same clean result, months apart
Words / Pair 36An old signed statement against A current one
A signature proves authorship, never freshness. Only a date written into the text does that.
The test: Look for a date the signer wrote into the signed text itself
You cannot check an image, however clear it is
Words / Pair 37A picture of a signed block against A signed block
One can be handed to verifying software. The other is a photograph of something that may never have existed.
The test: Try to select the text. If it will not select and copy, there is nothing to verify
One of these strings was chosen by somebody
Words / Pair 38A fingerprint that matches against A name that matches
The name in a key was typed by whoever built it. The fingerprint is derived from the key material.
The test: Ask which string a person could have typed, then compare the one they could not
Posted where, and written by whom
Words / Pair 39An announcement on the site against An announcement about the site
Where a notice sits tells you who controls that page. Only a signature tells you who wrote the words.
The test: Ignore where it sits. Ask whether it is signed by a key whose fingerprint you hold
Who granted it, and what were they promising
Words / Pair 40A badge against An identity
A badge is a statement by the interface showing it. An identity is a key you can check for yourself.
The test: Ask for a signed line and check it against a fingerprint you already hold
Two lists of addresses, two different guarantees
Words / Pair 41A signed list against A published list
One proves control of a page. The other proves who wrote the lines, wherever they end up.
The test: Check whether the addresses sit inside the signed text or merely beside it
Where the key came from is the real question
Every one of these pages ends up in the same place. Not is the signature good, but where did the key come from and did you have it before the message arrived. A key that came attached to the message it signs proves that the message is internally consistent and nothing more, which is a property a forgery has too.
This is unsatisfying because it means the value of a check made today was decided months ago by whether you kept a fingerprint. There is no way around that. It is a property of how the arithmetic works rather than a gap somebody forgot to fill.
What is deliberately missing
No software names, no versions, no command lines and no setup instructions appear on these pages. Plenty of other places cover that, and the pairs here are about interpretation rather than tooling. If you already verify things, these pages are about what your results have been telling you.