TORZON//ACCESS

PGP bench // verify yourself // 2026

Torzon Signature Bench

A signature check is not a vibe. It is one command that returns a clean pass or a hard fail, and the fail ends the session. This bench walks the whole thing: load the key once, verify the signed record, and read the output like a switch, not a suggestion. The onion string itself stays on the card.

Canon pointerThe bench proves a string; it does not store one. The signed onion and the full set live on the card:torzonguqmlfy2kfi5tjbnt4bp3idtkjzi4qtupmhpdihjftomjtdzqd.onionOpen the card
The whole ideaone command

How one command settles the question

Verifying an onion sounds heavy, but it collapses into three beats. You load a key, you run a check against a signed file, and you read a verdict. Everything else on this page is detail hung off that spine.

Torzon signature bench flowImportthe keyVerifygpg --verifyVerdictpass or fail
1 // ImportThe published key goes into your keyring one time. Everything after is weighed against it.
2 // VerifyA single command checks the signed record against that key. No guessing, no reading the page for clues.
3 // VerdictThe output is a clean pass or a hard fail. There is no maybe, and a fail closes the session.
The benchone pass at a time

Five moves to prove a signed record

  1. Pull the Torzon signing key into your keyring. This happens once and sets the yardstick for everything that follows.
  2. Grab the signed record and its detached signature in the same breath. You need both files side by side.
  3. Run the verify command on the pair. The tool does the maths so your eyes do not have to.
  4. Read the line it prints. A good signature from the canon key is the only pass; silence on the key is a fail.
  5. Set the printed fingerprint beside the one you already held. Equal, and you proceed. Off by anything, and you walk.

Nothing here runs on our servers. The command runs on your machine, against files you fetched, and we never see the result.

Up closethe commands

The two lines you actually type

Here are the commands with nothing hidden. The first plants the key. The second weighs the signed record against it and reports back in plain words.

gpg --import torzon-signing.asc      # once, up front
gpg --verify torzon-mirrors.sig torzon-mirrors.json

Watch the second line. A phrase such as "Good signature" tied to the canon key is your pass. A "BAD signature", an unknown key, or no signing line at all means you got nothing, and nothing is a fail.

Pass

Good signature

The record is authentic and every address inside it was signed by the canon key. Copy your onion from the card and open it in Tor.

Fail

Anything else

Bad signature, wrong key, or no result. The record cannot be trusted and neither can the addresses in it. Close the tab and begin again from the card.

Questionsshort answers

Bench questions people ask

What if gpg prints BADSIG?

Stop. A BADSIG means the record was altered after signing, or the signature does not belong to the key you hold. Either way the addresses inside are not trustworthy. Close the tab and start over from the card.

Do I need the key before the record?

Yes, in that order. Hold the signing key first so the record has something to be measured against. Pull the record first and you are tempted to trust it before you can test it.

The signing key is pending, so what do I check now?

Until the key ships in Phase 0, the bench is a dry run. For now, read the full 56-character string against the card by eye and watch the canary. The command flow above is exactly what you will run once the key is live.

Next

Know what a clone looks like

A signature is the proof. Knowing how a fake is built tells you why the proof matters and where the eye gets fooled.

Read the clone teardown