PGP

PGP is the check that comes before a market password. Directories say “verified” when a probe got a response. A response is not a signature. Nexus left no signed farewell in October 2026. That absence is part of the exit filing, not a missing paragraph.

You keep a private key and you publish a public key. The private key does not get pasted into a market, a chat, or a support form. A signed mirror list only helps if the fingerprint is one you already stored. A fingerprint printed beside the claim is the claim.

The box labeled encrypt on a market page sees the text before it locks anything. Ciphertext should exist on your machine first. 2FA belongs in that same first session. Practice on a throwaway identity. Pair this with how to verify an onion link.

A research brief. Onion strings belong in Tor Browser. Clearnet hubs are not logins. Filed 17 October 2026.