PGP Guide — Verifying DarkMatter Market Onion Signatures — Update 28

Phishing remains the single most prominent threat vector targeting darknet market users today. Threat actors routinely clone the visual layouts of prominent portals, presenting convincing replicas designed to capture your login credentials, PINs, and mnemonic recovery phrases.

By accessing DarkMatter Market links without cryptographically verifying their signatures, you expose your session to potential hijacking. Cryptographic verification ensures that the list of onion links you are utilizing was compiled and signed by the actual administrators of DarkMatter Market. If even a single byte of the onion address text is altered, the signature fails validation.

Before you can verify any signed message, you must import the verified public key of the market into your local PGP keyring. This key is the root of trust for all official announcements and list changes.

The official public key can be acquired from trusted distribution channels, our established mirrors, or verified indexers. Once you obtain the raw text block, save it as a local file (e.g., darkmatter_pub.asc).

To import the key using GnuPG on your terminal, execute the following command:

If you are utilizing a graphical user interface like Kleopatra (common on Tails OS or Whonix), simply select "Import" from the top menu, choose the saved key file, and click certify.

With the public key imported and marked as trusted, you are ready to verify the signed mirror lists. A signed message typically contains the actual message content wrapped inside cleartext signature boundaries:

To verify this content, copy the entire signed text block (including the BEGIN and END lines) and save it to a file named mirrors.asc.

Run the verification command via terminal:

Observe the output carefully. You are searching for a specific status indicator confirming a valid signature.

GnuPG will present one of three fundamental results upon executing the verification command. Understanding these outputs determines whether it is safe to proceed:

• Good Signature (Safe): The output explicitly displays gpg: Good signature from "DarkMatter Market...". This guarantees the file was signed by the key holder and has not been altered in transit.
• Good Signature but Untrusted: You may see a warning indicating the signature is good but the key is not certified with a trusted signature. This is normal behavior if you have not manually assigned trust to the imported key. The cryptographic integrity of the list is still valid.
• BAD Signature (Dangerous): If the output reads gpg: BAD signature from..., it indicates the document has been tampered with or modified. Destroy the file immediately and find an alternative source for your links.

Should you run into verification issues, confirm that you have not introduced formatting errors. Common causes for validation failure include:

1. Trailing Whitespaces: Ensure no extra spaces or blank lines were injected into the bottom of the raw signature text block when copying it from your browser.
2. Incomplete Copying: Double check that the boundary dashes (e.g., -----BEGIN PGP...) are perfectly intact. Any missing dash invalidates the signature parsing.
3. Incorrect Key Selection: Ensure you are validating the signature against the actual DarkMatter Market key and not an outdated key from previous iterations of the market.