New PGP Key Hygiene Guidelines for Darknet Market Users

Privacy advocates and darknet community security researchers have collaboratively published updated PGP key hygiene guidelines addressing common mistakes that have led to user identification in documented cases. The guidelines update earlier recommendations to address current threat models and tooling.

Key updated recommendations include: using Ed25519 keys rather than RSA 2048 for new keypairs (smaller, faster, equivalent security at modern threat levels); setting 1-2 year expiry dates on all keys to limit damage from key compromise; using a unique key per platform and persona with no cross-platform reuse; generating keys on an air-gapped or Tails OS machine to prevent key material exposure; and storing private keys only on encrypted, offline storage.

The guidelines also address the increasingly common attack of platform PGP key substitution — where attackers compromise an account and replace the PGP key to intercept future communications. Regular key verification against a signed, published fingerprint remains the only reliable protection against this attack vector.