Verify a Market Alternative with PGP Before You Switch
Why Verification Matters Most at Switch Time
The moment a popular market goes down, users search for alternatives — and phishing operators are waiting with cloned sites and look-alike addresses. Verifying an alternative's address with PGP before you switch is the single most important safety step.
The Steps
1. Get the market's public key from its own .onion homepage, its signed canary, and at least one independent community source. Cross-check the fingerprint across sources.
2. Import it: gpg --import market_key.asc then gpg --fingerprint KEYID. Confirm the fingerprint matches every source.
3. Download the signed mirror list / canary published by the market.
4. Verify: gpg --verify mirrors.txt.asc. A Good signature from the market's key means the address list is authentic. A BAD signature means do not use any address in it.
5. Use only verified addresses, bookmark them immediately, and re-verify every few weeks since markets rotate mirrors.
Red Flags While Switching
- An "alternative" promoted only via Telegram, Reddit or clearnet search ads
- Addresses that differ by one or two characters from the real one (homoglyph attacks)
- A site that demands login and a deposit before letting you browse
Verify first, then switch. Never the other way around.