How do I sign Kraken's public key?

Anyone can create a PGP key for any email address. So when you see a signed message claiming to be from Kraken, you want to be able to make sure that the signature came from our official key and not an imitator.

Immediately after importing our key to your PGP/GPG mail application, be sure you sign it.

Signing a public key

When signing our public key, carefully check that the PGP fingerprint matches the one on our website. The email address being the same is not enough.

In GPG Mail (for AppleMail):

Sign-our-public-key-exchange__GPGMail_.png

If you want your email address to remain private from PGP keyservers, make sure to leave "Publish" unticked.

After you sign our key, be sure to restart your mail application for the updates to take effect.

In Enigmail (for Thunderbird):

Sign-our-public-key-exchange__Enigmail_.png

You can select "I did a quick check" after double checking that the fingerprint of the key you're signing matches the one on our website.

"I have checked very carefully" is only for people who you know in-person.

If you want your email address to remain private from PGP keyservers, make sure to tick "Local signature".

 


Trust your own private key

Your PGP/GPG mail application might not trust your personal private key that you have stored with it, especially if you imported it from a backup or another PGP/GPG application.

If this is the case, the public keys signed by that private key will also be considered untrusted.

To fix this, check the settings of your private key (not our public key) and make sure that "Ownertrust" is set to "Ultimate".

In GPG Mail (for AppleMail):

Ownertrust-of-personal-key__GPGMail_.png

In Enigmail (for Thunderbird):

Ownertrust-of-personal-key__Enigmail_.png