Verify announcements signed by 0trace

The fingerprint uniquely identifies the key. Compare it with the value you see when running gpg --fingerprint after import. If the two strings differ, do not trust the imported key.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEafeDUxYJKwYBBAHaRw8BAQdA7yyfU9fkvxSVjxdr3yhFf2rLqU9mR67AoIYK
h2+/9ne0OzB0cmFjZSAoUHVibGljIHNpZ25pbmcga2V5IGZvciAwdHJhY2UuaW8p
IDxoZWxsb0AwdHJhY2UuaW8+iLUEExYKAF0WIQTIoD6vZTHJdVYfn9obgAuY0nxW
EQUCafeDUxsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwyLDECGwMFCQlmAYAFCwkI
BwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQG4ALmNJ8VhFa2gD/bprsNkiAc2eJ
+KmJaWjvu5VHZzf6HRUZWGUw0ZgLkbABANNA97o0LpC9eWzoNqNZvv+k1aTWYAzM
OiBI5fsge1ECuDgEafeDUxIKKwYBBAGXVQEFAQEHQGWwE3poVwp02Jrzfdrg/IJg
hwME1IUXBieW/qOLtKcvAwEIB4iaBBgWCgBCFiEEyKA+r2UxyXVWH5/aG4ALmNJ8
VhEFAmn3g1MbFIAAAAAABAAObWFudTIsMi41KzEuMTIsMiwxAhsMBQkJZgGAAAoJ
EBuAC5jSfFYRn+QA/AngIZbO1zqguOmybsPf+tZtkIiHND6gkrAEFQAAQdNMAPsF
+jLwP9zt4bejNuvAC4zFHQKBiK/wXdSvorSjJbTMDg==
=K/HV
-----END PGP PUBLIC KEY BLOCK-----

1. Import the public key directly from the website:

curl https://0trace.io/0trace-pgp.asc | gpg --import

2. Or import a downloaded copy:

gpg --import 0trace-pgp.asc

3. Confirm the imported fingerprint matches the one published on this page:

gpg --fingerprint hello@0trace.io

4. Verify a signed message:

gpg --verify announcement.txt.asc

A successful verification proves the message was signed by the holder of the 0trace private key and the contents have not changed since signing.

• PGP (this page)— signs public communication: announcements, advisories, listing acknowledgments. Private key lives offline and never touches production servers.
• Ed25519 (/verify)— signs per-order Guarantee and Receipt documents automatically for every exchange. A different key, generated independently.

Compromise of one key does not affect the other.