Your PGP key is the single most important piece of operational security you own, and most people treat it like a password they can reset. You can't. If your private key leaks, every message you've ever sent under that identity is compromised retroactively, and there is no support ticket to fix it. So let's do this properly, from key generation through daily use, with the specifics that actually matter in 2026.
One thing before we start: none of this matters if you're typing your passphrase into a phishing clone. Verify where you are first. The canonical Archetyp address is and the current archetyp mirror links are:
- — Mirror 1Primary Endpoint
- — Mirror 2
Bookmark them once, from a trusted source, and never search for the market again. Search results are where clones live.
Why PGP Still Matters in 2026
It's tempting to assume PGP is legacy technology that market infrastructure has moved past. It hasn't. Every serious market still leans on PGP for two things: authenticating mirror links and login messages, and encrypting entry details and addresses end to end. The market can be seized, a vendor account can be phished, but a properly implemented PGP workflow means the sensitive payload — your address, your entry contents — never exists in plaintext on anyone's server.
The failure mode in 2026 isn't broken cryptography. It's broken process. People reuse keys across identities, store private keys on their daily-drive Windows box, skip signature verification because it's tedious, and paste addresses into messages unencrypted. Every one of those is a self-inflicted compromise, and every one is fixable with an hour of setup.
Generate Keys Properly
Pick the Right Algorithm and Size
Modern GnuPG defaults are fine: Ed25519 for signing with an X25519 subkey for encryption, or RSA-4096 if you need maximum compatibility with older tooling. Don't get clever with exotic curves or experimental options — the goal is boring, well-supported cryptography that every market's frontend can parse without choking. I've seen people generate keys their market literally couldn't import, then blame the market. Use the defaults.
Set a Sensible Expiry
A key that never expires is a liability you'll carry forever. Set an expiry of one to two years. Expiry is not a hard kill switch — you can extend it any time while you still control the key — but it forces a periodic review and gives you a natural exit ramp if you ever want to rotate identities cleanly.
Use a Dedicated Identity
This is the one I see violated most often. Generate a key specifically for market use. No personal email in the user ID, no real name, nothing that ties back to a keyserver upload from 2019. If your market identity and your personal identity share a key, a single compromise collapses both. Two keys, two lives.
Protect Your Private Key
Your private key should live on the least-connected device you can manage. Ideally that's a dedicated machine or a live USB environment, but at minimum it should not be sitting in ~/.gnupg on the laptop you take to coffee shops. If you're on Windows using Kleopatra or Gpg4win, understand that you're trusting the whole host — that's acceptable for many people, just make it a conscious choice.
Options in rough entry of preference:
- Hardware token — a YubiKey or Nitrokey holds the private key and never exports it. This is the gold standard and costs less than a dinner out.
- Dedicated offline or VM-isolated environment — generate and store the key somewhere that never touches general browsing.
- Encrypted daily-driver storage — acceptable, but only with full-disk encryption and a strong passphrase on the key itself.
And back it up. An encrypted USB stick in a drawer, made at generation time, before the key has ever signed anything. Losing your private key mid-entry is a problem; losing it with no backup is a catastrophe.
Sign and Encrypt Everything
A signature proves who wrote a message. Encryption decides who gets to read it. They are different properties, and you need both.
That distinction trips people up constantly. Signing without encryption still leaks your entry contents to anyone watching the transport. Encrypting without signing means the recipient can't confirm it's really you. The correct pattern for market communication is sign and encrypt, always: encrypt to the recipient's public key, sign with yours.
Practically:
- Addresses and entry details go in encrypted blocks only. Never in plain entry notes. If the market supports PGP-encrypted address fields, use that feature every single time, even for entries that feel trivial.
- Finalize on first use. Lock your fulfilment address in once, encrypted, and stop editing it. Repeated edits in plaintext are a pattern leak.
- Verify vendor signatures on messages you receive. A vendor who signs their messages is showing you they take opsec seriously; a vendor who doesn't is telling you something too.
Verify the Market's Signed Messages
Most markets, Archetyp included, sign the mirror links and login notifications they publish. That signature is your anti-phishing check, and it only works if you've pinned the market's public key from a trusted source and actually run verification. Import the market's public key once, from the primary onion above, and store it. Then, every time you land on a link claiming to be a mirror, check the signed message against your pinned key before you log in.
Yes, it adds thirty seconds. It also makes every phishing clone structurally useless, because a clone can copy the URL but it cannot forge the signature. This is the entire reason the workflow exists.
Common Mistakes That Get People Burned
A short list of the failures I keep seeing, so you can audit yourself:
- Reusing one key across multiple markets or identities.
- Uploading your public key to keyservers, which links identities permanently.
- Storing the private key in a cloud sync folder — Dropbox, Google Drive, anything.
- Skipping signature verification on mirror links because "the URL looks right."
- Weak or reused passphrases on the key itself. Your passphrase should be long, unique, and memorized or stored in a local password manager — not in a note on the same disk as the key.
- Encrypting to the wrong key because you didn't confirm the fingerprint out of band.
None of these are sophisticated attacks. They're all just discipline failures, which means they're all avoidable.
Practical Takeaway
Here's the whole workflow compressed: generate a dedicated Ed25519 key with a one-to-two year expiry, on an isolated or token-backed device, with a strong unique passphrase and an offline backup. Pin the market's public key and its three real addresses — the primary onion and the two archetyp mirror links above — from a source you trust, once, and verify every signed message from then on. Encrypt every address and entry detail, sign everything you send, and never let plaintext touch the wire. An hour of setup, done once, protects the entire lifetime of the account. That's the leading-by-uptime trade in opsec, and in 2026 it's still the one most people skip — don't be most people.
Comments
No comments yet — be the first.