The PGP key

Everything private on Black Ops travels by PGP. Password resets, login confirmations, support threads, the signed mirror list. There is no plaintext email behind the scenes, and the key below is the one end of the lock that the market holds.

The key's identity

• Identity: Black Ops <[email protected]>
• Fingerprint: 03D4 A411 AC86 38C2 7049 C980 06DF 63DB 2AA3 B0E7
• Key ID: 06DF63DB2AA3B0E7

Import it, then read it back

Save the block below to a file, import it, and ask your tooling for the fingerprint. The output must match the string above exactly. If it does not, the key in your hand is not the key that signs, and every verification that follows is built on sand.

gpg --import blackops.asc
gpg --fingerprint [email protected]

-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBGbYBnUBEACx1KwI0EPlR5+Eou4F/V1rmvd2aURBtY7H7HCttuNav7mgUpW7
UVeYYHs1yKy9VGHg5gM+hIcIFaP7z2g4Gvvz3en2br3TCfHik+6mfTS/jBgA5VdU
8gUTXJT3Ds9SAAFL6IaFTaFmmS76AZhzHgcWXkqTVfKqgUAKZgjmgfUONg2ExLT+
X9+JPOPirWy2DDWzqsX2qR2lxBaAaven9g0fT7a3VdSHKkbodjQbVaiGKcQuDLbX
t9Qd8hoCNaJcwPUGAGRNgb67wED+nRes6G4Vf9fqVBMjBzHZ0ez/IqSfRS+BTBzA
NEsX5XxVcFUKU7bNA+xH4cxzJbk5rtSOGFUZAnLdLfnE5p4As4o2Tb44bwav+Wvj
zenVehTrPFsf38NKXs8aBndoWbGcF+95Z+/j1eSkCqrZUiwm7A2VLu0feBGVZzr/
dIoo3+NcRhF+SqSrYmE1atxUOKP1zruf43KcXiAL1CmSkKMZkh1/+1blMpQ0f41x
MOfb4kzE2KdqX/OyOhqUL37/bA84vOij7FU4m7Ewr5oZBI9tgZUIrs2trMG/CwDx
y/Hnp9lg1hiusZNHW04Vfl3i8WowZPYx6Mopdhxobu+x10d1/maosyh5E65bN9ss
F6s+XvVbsVemCrksemSCXz29q+gjRENSp1duMnqJmmCN1AAOJlHn6al2GQARAQAB
tBxCbGFjayBPcHMgPGJsYWNrQG9wcy5tYXJrZXQ+iQJOBBMBCgA4FiEELkKk9bUu
MUbWf/tAoSU3z2yqqNEFAmbYBnUCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AA
CgkQoSU3z2yqqNGU9Q/9HU5aAeXJ0LycDnTvUf2NEJm/V7cqlMSo3G42IAN3ySSR
QG1KIWHVjN12Mp8fpXbabmnsXU1tAKWuo+EvEuko5KDDCsOE1lRHMbRwBU1Y3D//
RE36XFe1jsHBOHuTVCYp/AKWU9SvxsjBi1JEX72X0BR5bpI4gLpNl6/hHJmiTg1w
pco/93nrX3252Tz6rfhIBflLU++Dq+UcQ4z932qk0/T/EEahkU9qlcxB/89NXrd6
Q0aew35jpf3RrejgLlLvDsv1thuWI4ZCOvkeA6EtMwwqEAl3197u2cIFMGDyBAeJ
efi6uo5KBnxuv4PBq9bCoCaUWsB7HzYBSHl4Bn0jhMdpvR45iWv/UltEnHVdrWfz
h+j8etpytx+dzS1LuW3hOdsp/aUCQ3dYVdTce13TLgpNJbEsfbT0+t6UWL/ObSE9
KJcUbwz5k8CL9Tc+GFePgRJlUQCevkmDL2jiaoi78bTfMlkOsdAsFp0IauScuYcD
fv1aoCcYeUe05Pvnce5eeLr3t87YA0iLeS5XqdseRS7sUzk+pXo5ty3gDBYU9HTn
Rt1Z0N4J8rZWJII9VPGIkfb2IDlpzSET51XTSC/HqPFKEw8vql8aIyYUJImVlzXu
OqdpZke0cFhTBPL/N5csfbU66i/gOwI2+8h4MZ7Mf3bu95LZ3H9vNWJt89XPyb+5
Ag0EZtgGdQEQAOS0kn38gN9qzAA+KCZ2uvXCrUBritKQ+LebV96UGSpWWzyqPb1/
XFfeFcYi05MP/ccLwk+JmAHBZWPVVVj5qU574slmfNnS9CGb4pXDDekcib1JwkYG
9jYbY+4pxbjCHIzCb6D3bfom+dCztuN30dj09ythpyS+/QdZItRvLer3RwkBnpUG
AqyPpVtm0vcf4KPcfzV3q350zMrdoK4ykNCClDnNF4uqZSkrHVPUDATZW5wRab0M
rt7W3M9dGKb8kAXtYj3gA9IN0e1nwBXPQOYLdVsRkM4P50l8M66aP3warvzc9Gf7
/sbPXTpqxSOZ9e6zgmhyMQOBEB4IA7lzG5SO/nD7AYPK6hrVbYAmnLWN+SLr7Dqm
2B7n+XnrC0iUsgIct2Wh7UxG+p79y1puMc4A5rOtWeB5Q1BsPPE6U1JLtpEZxlf6
KMpxzB3ERJMi9VPX1EbB5n4PLugaZ46jHBLQfxIu35WsPlPW/mOhqT9smJOqeuer
xOBxylpxgfrF3Iza2PUlY9VbUYpOXHrMt+WJMjkoyg0GDvp58lD0bHsgQeHS/TxH
EQudKG8pS4/eNAG6bvL6GAVXq3ZsKmH2z6gocbJ1Wg49np6QDQEKNl5QJn6il8qb
l3ww9jEhhJWXiVSUa+OMzJ+CB+udpC/qT3ICjRsKvIapEsTOGRdkHrDlABEBAAGJ
AjYEGAEKACAWIQQuQqT1tS4xRtZ/+0ChJTfPbKqo0QUCZtgGdQIbDAAKCRChJTfP
bKqo0VH5D/9/MENWFbVMZoKNHrGJTBfvgGg1KwOdL9IQBNlAYC4RHw7BWzQRnzBS
lRUUf2Xe9Lxy38xhCS1KhKRx5YA13SNfMCkHcym/CG1K/y0WAMHYUu7rCJ23ITsM
x+NLP5YWcgb/+2cxHhATWuohkwan7mBaeojMzjz5pYYUJNtNh8vg6KqKNxXhCd8b
RllJZuwdhcz7wUJnBe7p6IaghpwV86K9PZ+A0EQQ7nnX6DQNUQadrWmW2UkgSq68
441qWVYoAD6AcycTKo3RN+LBBlHm3gMvJDI5uyXOZ5Q8aT5xjL9ESdlgNwY+TeUI
o/cVHCKOqbDvSIOWbSZX/+LJeeYqJTHkzWgAyuUoPI6ELL38K964SIMzIHP6/sVf
TfjwKkv7LXCSthv5rFJLiUZiVlK9I2HMJHYZplXGBOWupqmwomfWZ+ItnDFOX2XC
4PwnpF8do/zvpoBsLPfqaRchkLKjFX6pS6eQuhPn0rc2LTVLN3qokXrDK8lgZhjH
eDW6gQ65DgKN+er5lxN6cC2JiuClQtXWdcCs16K2WY0XBTs0QQc0OtdaneVUU+sc
xEKeyCnTS7aMvazxRU4pA/uPs9XYfDkSpJs2fdy8A7p79itRh3l7C0KULQDz4Lkh
2hS0P82MRbSEqL6SzO2PP3Duj7nyJaG8Px8fkLkUzOx7uDInJIatUg==
=rpuz
-----END PGP PUBLIC KEY BLOCK-----

Where to get it besides here: inside the market, on the page that publishes the PGP key, and on the market's Dread board, where announcements carrying the key are signed with it. Getting the key from a second, independent place and watching both fingerprints agree is the whole ceremony.

What signing actually does

You sign with your private key; the market checks the signature with the public key you registered. It is a stamp only your key can make, and it does not encrypt anything. A signed message says "this came from the holder of key X." An encrypted message says "only the holder of key Y can read this." The market uses both directions: it signs things so you can be sure they are the market, and it encrypts things so no one in between can be sure of anything at all.

The mail server, the exit node, the person with a laptop and a curiosity: they can all see the envelope. None of them can read the letter, and none of them can forge the stamp.

Loss, in the two directions

• Lose your public key: re export it. It is already on the market and on the Dread board. Nothing changes.
• Lose your private key: the account survives, but the mail stops being readable. Recovery codes still arrive, encrypted, to a key no one can open. This is the one that should make you back something up.