Limits of a check
Being honest about where verification stops is more useful than overselling it, and it changes what else you should be doing.
What it does establish
That whoever produced the signature held a specific private key, and that the signed text is unmodified. Chained to a fingerprint you pinned independently, that answers one question completely: whether you are where you think you are. No other tool available to you answers it at all, which is why the rest of this site points at it.
What it does not
- Anything about intent. A signature proves authorship, not that the author is truthful or has your interests in mind. A platform can sign a statement and the statement can still be self serving.
- Anything about your own machine. Verification runs locally, so a compromised system can be made to report whatever it likes. The check assumes a trustworthy machine and cannot establish one.
- Anything about what happens next. Confirming you arrived correctly says nothing about the session that follows, the order you place, or the vendor you deal with.
- Anything after a key compromise. If the private key is in someone else's hands, everything they sign verifies perfectly. This is lower probability than phishing and it is not zero.
- Anything about the goods. Obvious and worth saying, because people extend the confidence from one narrow proof outward into areas it never covered.
The failure mode this creates
People who verify carefully sometimes become less careful about everything else, because they feel covered. That is the predictable consequence of having one very strong guarantee in a situation full of weak ones, and it is worth naming so you can watch for it in yourself.
A verified arrival at the genuine platform still leaves you exposed to a vendor who does not ship, a balance sitting where it should not, a password reused from somewhere else, and a machine you have not thought about. None of those are affected by the signature at all.
What sits around it
| Question | What answers it |
|---|---|
| Am I where I think I am? | The signature check, and nothing else |
| Is my account protected if a password leaks? | Two factor, and unique credentials |
| Is my machine trustworthy? | How you set it up, and what you install. Nothing checked here can establish it. |
| Will this vendor deliver? | Reputation, with all its known limits |
| Is my money exposed? | Whether it is committed to an order or sitting as a balance |
| Can this be linked back to me? | What you did before any of this, at the boundary where money entered |
Six questions, one of which verification answers. The reason this site concentrates on that one is that it is the only one where the answer is definitive and cheap, not because it is the only one that matters.