GPG Check
Verify a detached OpenPGP signature against a downloaded APK or any other file — entirely on this device. Nothing is uploaded.
… or paste armored key
Where do I get these three files?
- Executable + signature: published together, e.g. Signal-7.apk and Signal-7.apk.sig (or .asc) on the project's download page.
- Public key: from the publisher's website or a keyserver. Enter a direct key URL or just the developer's email (looked up via Web Key Directory, falling back to keys.openpgp.org), or use the one-tap key-ID lookup after loading the signature. Cross-check the fingerprint against a second source (their site over HTTPS, a key card, a printed manual) — the whole check is only as strong as this step.
- A valid result means the file matches byte-for-byte what the holder of that key signed, at that time.