PGP
PGP is the check that comes before a market password. Directories say “verified” when a probe got a response. A response is not a signature. Nexus left no signed farewell in October 2026. That absence is part of the exit filing, not a missing paragraph.
You keep a private key and you publish a public key. The private key does not get pasted into a market, a chat, or a support form. A signed mirror list only helps if the fingerprint is one you already stored. A fingerprint printed beside the claim is the claim.
The box labeled encrypt on a market page sees the text before it locks anything. Ciphertext should exist on your machine first. 2FA belongs in that same first session. Practice on a throwaway identity. Pair this with how to verify an onion link.