Authoritative Public Index
This registry identifies the public values a verifier must compare before relying on an Onyx Mail artifact. It does not ask the browser to establish its own trust. Cryptographic verification remains a local operation under the verifier's control.
Registry State
Identifiers are shown in full. Truncated values are not verification substitutes.
[SIGNED ARTIFACT]
The current artifact is PGP-clearsigned and distributed through a stable well-known path. Its validity is bounded by dates inside the signed text.
SHA-256 of served clearsigned bytes
9fefdbc70bfc12dae639f8c15c7f8ab02dd14d5309b7fc26da9fc805746d0cc3
[CANARY KEY]
This key role is limited to the warrant canary. It is distinct from the key used for encrypted security contact.
Complete fingerprint
F60C F128 EE34 35F9 A4D5 3850 3421 FCA1 7ADF 0933
[CONTACT KEY]
This key encrypts security-report content sent to [email protected]. It does not sign the warrant canary.
Complete fingerprint
BCF4 79BE 7BF5 6646 600D 5CDD 84D7 298E 7EE5 650B
[TOR ADDRESS]
Compare the complete 56-character hostname and suffix before use. Tor changes the network path. It does not establish universal anonymity.
onyxxqklg2zhfojp7pzm6svwvwjrwkhrcp4mxbs7itu22nh3ggtpnbqd.onion
[MAIL TRANSPORT]
Sending servers are directed to deliver mail to Onyx Mail only over authenticated TLS to a listed exchanger. A downgrade to cleartext is refused rather than quietly accepted. Verify the policy at its source; the values below are what this deployment publishes.
Permitted mail exchangers
mailserver.purelymail.com, *.purelymail.com
dig +short TXT _mta-sts.onyxmail.net
dig +short MX onyxmail.net
curl -s https://mta-sts.onyxmail.net/.well-known/mta-sts.txtIndependent Procedure
The sequence matters. A signature verified against an untrusted replacement key does not establish the intended identity.
Obtain the complete expected fingerprint or Tor address through an independent trusted path. Do not rely on a short identifier.
Compare every fingerprint character or all 56 onion-hostname characters. Stop if any character differs.
Download the public key and clearsigned statement from their stable routes. Preserve the artifact bytes.
Use GnuPG outside the page. Confirm the expected full fingerprint, good signature, signed dates, and statement scope.
curl -fSLo onyxmail-canary-public.asc https://onyxmail.net/canary/public.asc
curl -fSLo current_clearsigned.asc https://onyxmail.net/.well-known/canary/current_clearsigned.asc
gpg --show-keys --fingerprint onyxmail-canary-public.asc
gpg --import onyxmail-canary-public.asc
gpg --verify current_clearsigned.ascTrust Boundaries
| Result | Establishes | Does not establish |
|---|---|---|
| PGP signature valid | The signed bytes match and the holder of the corresponding private key produced the signature. | Every statement is true, the signer is uncompromised, or no event occurred after signing. |
| Canary within period | The signed dates have not passed at the verifier's reference time. | Future availability or a condition after the signature time. |
| Tor address matched | The browser is directed to the compared onion-service identifier. | A safe endpoint, uncompromised browser, or anonymity under every threat model. |
| Artifact hash matched | The compared bytes are identical under SHA-256. | Authorship or truth unless a separately trusted signature is also verified. |
| MTA-STS policy in force | A sender that implements MTA-STS will deliver over authenticated TLS to a listed exchanger, or not deliver at all. | Protection for senders that ignore the policy, confidentiality after delivery, or any claim about message content. |
This page deliberately provides no browser-generated cryptographic verdict. The registry supplies inputs and procedures. Independent tools supply the result.