Download the Signing Key for Whonix ™ KVM
Since all Whonix ™ KVM releases are signed with the same key, it is unnecessary to verify the key every time a new release is announced. Trust in the key might gradually increase over time, but cryptographic signatures must still be verified every time a new release is downloaded.
This page is strongly related to the Placing Trust in Whonix ™ page.
Download the OpenPGP Key
Optional: Complete the steps below if unfamiliar with GnuPG or if they haven't already been performed.
Have GnuPG initialize your user data folder. 
Set warning free permissions.
2. Store the key as
3. Check fingerprints/owners without importing anything. 
4. Verify the output.
The most important check is confirming the key fingerprint exactly matches the output below. 
Key fingerprint = 04EF 2F66 6D36 C354 058B 9DD4 50C7 8B6F 9FF2 EC85
Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity.
5. Import the key.
The output should include the key was imported.
gpg: Total number processed: 1 gpg: imported: 1
If the Whonix ™ signing key was already imported in the past, the output should include the key is unchanged.
gpg: Total number processed: 1 gpg: unchanged: 1
If the following message appears at the end of the output.
gpg: no ultimately trusted keys found
This extra message does not relate to the Whonix ™ signing key itself, but instead usually means the user has not created an OpenPGP key yet, which is of no importance when verifying virtual machine images.
Analyze the other messages as usual.
6. Advanced users can check Web of Trust further below for better security.
7. Complete the Whonix ™ verification steps.
If verifying Whonix ™ images, navigate to the relevant verification page below to finish the process:
OpenPGP Web of Trust
1. First, acquire Patrick's signing key.
Refer the the more secure, detailed Whonix ™ Main, VirtualBox, APT Repository and Source Code Signing Key instructions.
2. Verify the key was also signed by Whonix ™ lead developer Patrick Schleizer.
The output should be identical to the message below.
pub rsa4096/0x50C78B6F9FF2EC85 2018-11-26 [SCEA] 04EF2F666D36C354058B9DD450C78B6F9FF2EC85 uid [ unknown] HulaHoop sig! 0x8D66066A2EEACCDA 2018-12-14 Patrick Schleizer <email@example.com> sig!3 0x50C78B6F9FF2EC85 2018-11-26 HulaHoop sub rsa4096/0xEB27D2F8CEE41ACC 2018-11-26 [SEA] sig! 0x50C78B6F9FF2EC85 2018-11-26 HulaHoop gpg: 3 good signatures
Download the signify Key
untrusted comment: signify public key RWT2GZDQkp1NtTAC1IoQHUsyb/AQ2LIQF82cygQU+riOpPWSq730A/rq
- GnuPG wikipedia - free OpenPGP software.
- Apache: How To OpenPGP.
- Debian: Keysigning - a tutorial on signing keys of other people.
- rubin.ch: An explanation of the PGP web of trust.
When a GPG error is encountered, first try a web search for the relevant error. The security stackexchange website can also help to resolve GPG problems. Describe the problem thoroughly, but be sure it is GPG-related and not specific to Whonix ™.
More help resources are available on the Support page.
- Verify Whonix ™ Images
- Verifying Software Signatures
- Placing Trust in Whonix ™
- OpenPGP key distribution strategies
Whonix ™ KVM/Project Signing Key wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Whonix ™ KVM/Project Signing Key wiki page Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP <firstname.lastname@example.org>
This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.
This will fix eventual
gpg: WARNING: unsafe ownershipwarnings.
curl --tlsv1.3 --proto =https --max-time 180 --output ~/hulahoop.asc https://www.whonix.org/hulahoop.asc
- Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 untrusted comment: signify public key RWT2GZDQkp1NtTAC1IoQHUsyb/AQ2LIQF82cygQU+riOpPWSq730A/rq -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEZvRiRskAcH/xDcHk6yfS+M7kGswFAl9FA2ZfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDY2 RjQ2MjQ2QzkwMDcwN0ZGMTBEQzFFNEVCMjdEMkY4Q0VFNDFBQ0MACgkQ6yfS+M7k Gsx0Ig//XIWcAU6FEy5BOPZp7mG6kGYUXJJNrMQzIW8JK49TlwHIRM6JjilUmn07 pV0Gq7RKAs9gLZWa4YbygUj0wZcaILLaqsmF0Np0mJuhkADiQVCJbLbrPanJACqy cs/3ALqqVEYHmZgtmQzWGKOiwHF+g4UtSmr4iNo2ykssGfcx/FHifisoeRe/Bku1 E++Z01kwIesQbETMF9x/PakxEHl0hCAES9ReRXhoDj87i4BEzqVa8m+/PS7woQEQ U6NA28ANreIpHYdQ2vGnWFc6JIrf5B10QVPd0JOwEO2w9efeVpgdCUNhA/SBx3jo j0kZZsF9gGuybrSysd7Ftn9XxA/S5rmWOzIL2miRbSrZpd2n5k0zlhyZoHGVKg3S bDhZr+Cw4BMMpiRcTtm11XwHcPDB4DkQL5MMrb+ISDe9Xy+zcEkGGY3da9JcNSQ8 6F9PziVyyO1jnOruZSoEmrB+vdKFl/yO007IIeByPCcsGdr1ITyEd6LAByV5SzxI Xp98gOO07rwrH6rUYSE75ErRwqQM9pKoVCZQbTantss+6kXLxxXDSFbkmRmyBTVS 3+kyshd53CQSsShb9lwroBSQJEj/Rfh+X8bvZe7sQFKY9/3GT5fktEteY1qkOSX7 HYttYy0gOeaawq8RhRxN+l3oOi9Zwll3kOpagj5xvNyrfwayp/E= =2wdp -----END PGP SIGNATURE-----