PGP for Market Buyers: Key Verification and Encrypted Messaging Basics

I have watched buyers lose a package not because a market got raided, but because their shipping address sat in a vendor inbox in plaintext. PGP fixes that one failure mode. It does not fix everything else.

PGP in one minute

PGP gives you a key pair. The public key is a mailbox slot anyone can use. The private key is the only thing that opens it. If you encrypt an address to a vendor’s public key, only that vendor’s private key can read it. That is the whole trick.

The same key pair can also sign messages. A signature proves the message came from whoever holds the private key. On a market, that can help confirm you sent an address, but it also means you should not sign anything you would not want tied to your key.

KeychainPGP keeps the friction low

KeychainPGP is one option for doing this without living in the command line. Its web app runs entirely in the browser using WebAssembly compiled from Rust, and nothing is sent to a server. That is useful on a shared or low trust machine, though I still would not generate a long term key on hardware I do not control.

The docs also mention a desktop app for Windows, macOS, Linux, and Android from the GitHub releases page. I prefer desktop for anything I keep, because a browser tab is one more thing to close by accident. The web app is still a good way to learn the flow.

Generate the pair

Open the Keys tab and create a new key. Enter your name and email address. KeychainPGP generates a modern Ed25519 plus X25519 key pair. Ed25519 handles signing. X25519 handles encryption. You end up with a public key to share and a private key to protect.

Do not treat the email field as identity proof. It is just a label. On a market, the vendor’s published key and its fingerprint are the things that matter.

Export and share only the public half

After generating your key, use the export function to copy your public key in ASCII armored format. It looks like a block from —–BEGIN PGP PUBLIC KEY BLOCK—– to —–END PGP PUBLIC KEY BLOCK—–. You can paste it into email, chat, a website, or upload it to a key server such as keys.openpgp.org.

ASCII armor is just binary data encoded as printable text. That is why it can be copied into emails, chat windows, web forms, or any other text based medium. Without it, a PGP message would be raw binary data and impossible to paste where you need it.

Important: only share your public key. Never share your private key with anyone, under any circumstances. Your private key is what keeps your messages secure.

Verification is the part people skip

Importing a key is easy. Trusting it is the hard part. KeychainPGP’s docs warn about man in the middle attacks, where someone gives you a fake public key and intercepts your messages. The fix is boring: verify the key’s fingerprint through a separate trusted channel, such as a phone call or an in person meeting.

On a market, that means comparing the fingerprint shown in your app with the fingerprint the vendor publishes in more than one place. If the vendor only posts a key in one spot, that is a weak signal. If the fingerprint changes between orders, stop and ask why. I have seen “updated key” messages that were just a hijacked account.

Key servers are a lookup tool, not a trust oracle. keys.openpgp.org can help you find a key by email address, but it does not tell you that the key belongs to the person you think it does.

Encrypting without leaving the clipboard

Once the vendor’s key is imported, go to the Encrypt tab. Type or paste the message, select the recipient from the key list, and click Encrypt to Clipboard. You can select multiple recipients if the message is for more than one person. The encrypted message, an ASCII armored PGP message block from —–BEGIN PGP MESSAGE—– to —–END PGP MESSAGE—–, is copied to your clipboard.

Paste it into whatever channel you are using. Only the selected recipient or recipients can decrypt it. Even if someone intercepts it, the message is unreadable without the recipient’s private key.

The desktop app is faster. Type the message anywhere, copy it, press Ctrl+Shift+E, and KeychainPGP encrypts the clipboard contents to your default recipient. The entire encrypt and replace cycle takes about one second. That speed is the difference between people actually using PGP and people typing “I will encrypt later.”

One habit I like: keep the plaintext short. Put the address and order note in the encrypted block. Put nothing useful in the subject line or surrounding chat. Metadata leaks even when the payload is locked.

Decrypting, and keeping plaintext off your screen

To read an encrypted reply, copy the entire encrypted message block, from —–BEGIN PGP MESSAGE—– to —–END PGP MESSAGE—–. Go to the Decrypt tab, paste the encrypted text, and click Decrypt. If the message was encrypted to your public key, the decrypted plaintext appears immediately.

With the desktop app, select and copy the encrypted message block from any application, then press Ctrl+Shift+D. KeychainPGP decrypts the clipboard contents using your private key, and the decrypted plaintext replaces the encrypted text on your clipboard. The desktop app also features clipboard auto clear: after 30 seconds, the decrypted text is automatically wiped from your clipboard to prevent accidental exposure.

If you use GPG directly, gpg –decrypt message.asc does the same job. Either way, do not decrypt on a machine you do not trust, and do not leave plaintext sitting in a chat draft.

What PGP does not save you from

PGP protects message content in transit. It does not protect your account if your password is weak. It does not protect your endpoint if your laptop is compromised. It does not prove a vendor is honest. It only proves that the person holding the matching private key can read or sign a message.

It also does not hide timing, message size, or the fact that you are using PGP. If your operational security depends on those things, PGP alone is not enough.

My practical rule set

• Generate the key on a machine you control, and back up the private key offline.
• Verify fingerprints out of band before sending anything sensitive.
• Encrypt the address every time, even when the market has a “secure message” box.
• Decrypt on a clean machine, and let the 30 second clipboard clear do its job.
• If a vendor’s key changes mid conversation, treat it as a red flag until proven otherwise.

Research only

Research only. This is not a guide to buying, selling, or evading law enforcement, and nothing here should be read as operational advice for illegal activity.