Liquid glass desk · 17 October 2026 · not a shop

PGP

PGP is the check that comes before a market password. Directories in the first results say “verified” when a probe got a response, or when a page wears their badge. A response is not a signature.

Two keys, and which one leaves the machine

You keep a private key and you publish a public key. Other people encrypt to the public key. Only the private key reads it. The private key does not get pasted into a market, a chat, or a “support” form. A weak passphrase on that private key is the same mistake as reusing a market password.

Guides on the desks Darkapple reads split the work into three jobs: lock a message, read one, and check a signature. Darkapple cares most about the third. A signed mirror list only helps if the fingerprint is one you already stored. A fingerprint printed beside the claim is the claim, not the proof.

Encrypt on your side

The box labeled encrypt on a market page sees the text before it locks anything. If that host is watched, copied, or seized, the plaintext was already there. Ciphertext should exist on your machine first. Do not treat the market’s box as PGP.

The same first session is where 2FA belongs, not after a deposit. Practice both on a throwaway identity. A lander that asks for the password before the phrase is skipped.

What not to paste

1. The private key, where the public key was asked for.
2. A vendor key copied off the same page you are about to pay.
3. A delivery note, a tracking line, or any real name in the clear.

Pair this with how to verify an onion link. The string check and the signature check are two different stops.

Research notes only. Onion strings belong in Tor Browser. Clearnet hubs are not logins. Stamp 17 October 2026.