Authoritative Public Index
This registry identifies the public values a verifier must compare before relying on an Onyx Mail artifact. It does not ask the browser to establish its own trust. Cryptographic verification remains a local operation under the verifier's control.
Registry State
Identifiers are shown in full. Truncated values are not verification substitutes.
[SIGNED ARTIFACT]
The current artifact is PGP-clearsigned and distributed through a stable well-known path. Its validity is bounded by dates inside the signed text.
SHA-256 of served clearsigned bytes
9d68c989c638b5762d5204560058c6612a3939807bb73855706414de44f19966
[CANARY KEY]
This key role is limited to the warrant canary. It is distinct from the key used for encrypted security contact.
Complete fingerprint
F60C F128 EE34 35F9 A4D5 3850 3421 FCA1 7ADF 0933
[CONTACT KEY]
This key encrypts security-report content sent to [email protected]. It does not sign the warrant canary.
Complete fingerprint
BCF4 79BE 7BF5 6646 600D 5CDD 84D7 298E 7EE5 650B
[TOR ADDRESS]
Compare the complete 56-character hostname and suffix before use. Tor changes the network path. It does not establish universal anonymity.
onyxxqklg2zhfojp7pzm6svwvwjrwkhrcp4mxbs7itu22nh3ggtpnbqd.onion
Independent Procedure
The sequence matters. A signature verified against an untrusted replacement key does not establish the intended identity.
Obtain the complete expected fingerprint or Tor address through an independent trusted path. Do not rely on a short identifier.
Compare every fingerprint character or all 56 onion-hostname characters. Stop if any character differs.
Download the public key and clearsigned statement from their stable routes. Preserve the artifact bytes.
Use GnuPG outside the page. Confirm the expected full fingerprint, good signature, signed dates, and statement scope.
curl -fSLo onyxmail-canary-public.asc https://onyxmail.net/canary/public.asc
curl -fSLo current_clearsigned.asc https://onyxmail.net/.well-known/canary/current_clearsigned.asc
gpg --show-keys --fingerprint onyxmail-canary-public.asc
gpg --import onyxmail-canary-public.asc
gpg --verify current_clearsigned.ascTrust Boundaries
| Result | Establishes | Does not establish |
|---|---|---|
| PGP signature valid | The signed bytes match and the holder of the corresponding private key produced the signature. | Every statement is true, the signer is uncompromised, or no event occurred after signing. |
| Canary within period | The signed dates have not passed at the verifier's reference time. | Future availability or a condition after the signature time. |
| Tor address matched | The browser is directed to the compared onion-service identifier. | A safe endpoint, uncompromised browser, or anonymity under every threat model. |
| Artifact hash matched | The compared bytes are identical under SHA-256. | Authorship or truth unless a separately trusted signature is also verified. |
This page deliberately provides no browser-generated cryptographic verdict. The registry supplies inputs and procedures. Independent tools supply the result.