- What it is
- A copy of a vendor's published public key, saved on your side, along with a note of where and when you took it from.
- How you get one
- Copy the published key block from the vendor's own page into a file, and record the date and source in the same file.
- Where to keep it
- A folder of key files on the machine you use for this, one file per vendor, named so you can find it without opening anything.
- How it goes wrong
- A vendor replaces their key and your stored copy silently becomes the old one, which then fails to match anything current.
- What fails without it
- You cannot check a signed message or prepare anything encrypted without first going to fetch material under time pressure.
- Time to acquire
- A couple of minutes per vendor, and it is worth doing several at once while you have the folder open.
Collecting keys out of season
The moment you need a key is a bad moment to go looking for one. You are partway through something, the clock feels loud, and any key you find will look correct because you want it to look correct. Collected on a quiet evening the same key gets a proper glance, a note of where it came from, and a filename you will still understand in six months.
There is no obligation to collect keys only for vendors you are dealing with. Gathering a handful at once is cheaper than gathering them one at a time, and an unused key file costs nothing but a few bytes.
What a stored key actually lets you do
Two things. It lets you check a signature on a message that claims to come from that vendor, and it lets you encrypt something so only the holder of the matching private key can read it. Both are checks you perform locally, using material you already have, without asking anything of the page you are reading.
That last part is the quiet benefit. A key fetched fresh from a page at the moment you need it verifies whatever that page says today. A key you stored last month verifies against what the vendor published last month, and the difference between those two is the entire point of storing it.
Filing so you can find one in seconds
- One file per vendor, named with the vendor name in a form you would type from memory.
- The source and the date written inside the file, above the key block, in plain words.
- A single folder rather than keys scattered through downloads and message archives.
- Old keys moved to a subfolder marked as superseded rather than deleted outright.
- A copy of the folder wherever the rest of your key material is backed up.
When keys change hands
Keys get replaced. People rotate them after a scare, after a device change, or on no schedule at all. A replacement is not automatically suspicious and it is not automatically fine. What it is, reliably, is a moment worth noticing rather than clicking past.
Your stored copy makes it noticeable. Without it a new key is simply the key, because you have nothing to compare against. With it, a mismatch prompts an actual question: when did this change, was the change announced anywhere, and does a signed notice you saved earlier have anything to say about it. Cross checking against independent sources is the sane response, not panic.
The failure this quietly prevents
The failure is not usually dramatic. It is you, mid order, needing to encrypt something, going to fetch a key from wherever it is published, and accepting whatever comes back because there is no time to do otherwise. Nothing bad has to happen for that to be a weak position. It is weak in itself.
Holding the key in advance moves the decision to a calm moment and leaves the busy moment as pure mechanics. That pattern repeats across this stage, and it is the same reason your own key gets made long before anybody asks you for it.
Questions that come up
Where should I take a vendor key from?
From wherever that vendor publishes it themselves, on their own profile or page, rather than from a third party who says they are passing it along. Note the source in the file so that six months later you can see what you relied on. A key with no recorded provenance is still usable but it tells you nothing about how much weight it deserves.
What if the same vendor publishes different keys in different places?
Treat that as a question rather than an answer. Save both, note where each came from, and do not assume the newer one wins. Sometimes it is an abandoned old key nobody removed and sometimes it is more interesting than that. Either way the disagreement is information, and you only have it because you stored a copy in the first place.
Do I need to understand the cryptography to keep one of these?
Not really. Keeping the file, noting where it came from, and noticing when it changes are the parts that carry most of the value, and none of those require any theory. Understanding the underlying scheme is useful eventually, but a carefully filed key with a dated source note is worth more than a vague grasp of the mathematics behind it.