PGP on Mars Market
PGP is how the market proves it is itself. Every vendor publishes a public key on their profile, and the operator pins its own in the storefront footer. You use the vendor key to encrypt shipping details in the order message, and the operator key to verify the canary and the deposit addresses. The encryption stays on your machine, which is the way the threat model was written.
Getting the keys
A vendor public key is available on their page as a downloadable block and as an inline copy field, so either way of importing works without leaving the Tor Browser. The operator key is in the footer. Import it once, pin the fingerprint, and keep it offline. The current operator fingerprint is 9F4C 2A81 77DE 0B3C 55A9 1E6F 8D24 C7B0 3A19 6E5D.
Encrypting shipping details
When a listing asks for a shipping address, encrypt it with the vendor public key and paste the result into the order message field. The storefront has no automatic PGP layer, because that would put a server side process in the path of plaintext. The encryption happens on your machine, and only the vendor can read it with their private key.
Verifying the operator
Cross check the footer key against the fingerprint you pinned earlier. An attacker running a lookalike onion cannot serve the same key without also holding the private half, so a matching fingerprint is strong proof you are on the genuine storefront. If the fingerprint has changed without a signed note announcing it, stop and check before you log in.
Frequently Asked Questions
Do I have to use PGP to buy?
No. It is required when a listing asks for encrypted shipping details, and recommended for verifying the operator.
Where is the operator key?
In the footer of the storefront, with its fingerprint.
What if I cannot read a signature?
Use a standard tool like GnuPG. Export the signature, check it against the imported key, and read the result.