Words / Pair 41 of 41
Two lists of addresses, two different guarantees
A list sitting on a page carries exactly one guarantee, and it is not the one most readers take from it. Signing changes what the list is worth. Nothing else does.
Publishing and signing are different acts
Fixed characters, portable
The addresses sit inside the signed text, between its boundaries. Copy the block anywhere and it still checks out, so the page carrying it stops being part of the question. Alter one character of one address and the check fails.
Whatever the page says today
Addresses printed on a page, styled well, perhaps under a heading that sounds official. The only thing established is that whoever controls that page put them there, which includes anyone who has taken it over and the owner on a day they changed their mind.
Publishing is an act of page control. Signing is an act of key holding. They feel like the same kind of authority when you are looking at a tidy page, and they answer different questions entirely.
A published list also has no history. It can change between two visits with no mark left behind, and the version you copied last week gives you no way to tell whether this week list is a correction or a substitution. A signed block cannot be edited quietly. Any change means a new signature, and a new signature means a fresh check.
Both lists look like a list
The failure worth learning is not a page with no block on it. It is a page with a real signed block that verifies cleanly, and a list of addresses sitting just outside it. Under the footer line, or above the header line, or in a neat panel beside it. The reader checks the block, gets a clean result, and reads the clean result as covering everything on the page.
| Where the addresses sit | What the check covers |
|---|---|
| Between the header and footer of the signed text | The addresses themselves. Any edit breaks the check. |
| Below the footer line | Nothing. They were added by whoever assembled the page. |
| In a panel next to a verified block | Nothing. Proximity is layout, not evidence. |
| On a page with no block at all | Nothing beyond who controls the page. |
Draw the line and see which side they fall on
Find the two boundary lines of the signed text and read the addresses as either inside them or outside them. Everything outside was written by whoever built the page, whatever the block above it says.
Where the key came from
A signed list is worth exactly as much as the key that signed it, and no more. If the fingerprint came from the same page as the list, the page has vouched for itself and you have gained nothing but a warm feeling. The whole of that argument is on the wrong key page, and the reason a name inside a key does not help is on the fingerprint page.
One line changed in a long list
The version of this that actually catches careful readers is small. A long list, mostly correct, with one entry altered. Nobody reads eight long addresses in full. The eye takes the first few characters and the last few, decides the shape is familiar, and moves on. That habit is the whole attack, and it works on people who would never fall for a page that looked wrong.
A signed block removes the need for that reading entirely. You do not compare the addresses at all, since a single altered character anywhere in the text breaks the check for the whole block. With a published list you are back to comparing by eye, which means comparing against something, and if the only copy you have came from the same page then you are not comparing at all.
What each one is worth
- If you ignore a signed list you could have checked
- You go looking for addresses elsewhere and end up on weaker sources, which is the wrong direction of travel. Cost is effort, plus the risk you land somewhere worse.
- If you use a published list as though it were signed
- You take addresses from whoever holds that page today. If that is not the operator, everything you do next happens somewhere of their choosing, starting with any payment.
- If it is signed
- Check it, then keep your own copy of the block rather than a link to the page. The block is the thing that keeps its value. The page can change under you.
- If it is published only
- Treat it as a lead and not as an answer. Do not send money to anything that reached you this way, and see the mirrors page for the addresses this site sets out and the limits on what that means.
Questions readers send about this pair
The list is on a page that has been right before. Is that enough?
It tells you the page has been right before. Pages change hands and owners change their minds, and neither event announces itself. A past record is a reason to look, not a reason to send.
Can I check a signed block that someone copied to a different page?
Yes, and that portability is the point. The check does not care where the characters were found, only that they are intact and that you know whose key produced them.
What if the block verifies but the list sits outside it?
Then the check covered the words inside and nothing else. Treat the outside list as published, however close it sits to the block.