What a PGP Signature Actually Proves (and What It Doesn't)

Published 6 October 2026

Your mail client shows a green badge next to a signed message and you feel reassured. Fair, but the badge is doing less work than it looks like it is doing. A PGP signature is a very strong claim about a very narrow thing, and the trouble starts when people read it as a broad claim about the sender. This article walks the chain of proof link by link, then lists every link that can fail, because each failure mode is something you can actually check for.

What the signature literally is

Underneath the badge, the process is short. Your email body is run through a hash function, which produces a short digest. That digest is encrypted with the sender's private key. The result is the signature, a block of data attached to the message. To verify, your software recomputes the digest of the message it received, decrypts the signature block with the sender's public key, and compares the two. If they match, verification passes.

So a passing verification proves exactly two things:

• The message bytes are the same bytes that were signed. Change one character anywhere in the signed text and the digests no longer match.
• Whoever produced the signature held the private key that pairs with the public key you checked against.

That is the entire claim. Notice what is absent: nothing in those two statements mentions a human being, a name, a company, or an intention. Everything people usually assume a signature proves has to come from somewhere else.

The missing link: the key is not the person

The badge turns green when the signature matches a key. It says nothing about whether that key belongs to the person you think it does. A user ID on a public key is just text typed in by whoever created the key. I can generate a key tonight that says it belongs to anyone I like, sign a message with it, and if you verify against my key without checking the binding, you will see a perfectly valid signature for that identity.

Binding a key to a person is a separate step from verifying a signature, and PGP gives you two ways to do it. The old way is the web of trust: other people whose keys you have already verified sign your correspondent's key, and you decide how much those signatures are worth. The newer way, covered in our piece on key transparency versus manual fingerprint checks, tries to make the directory itself auditable. Either way, the binding is its own problem, and it is the one attackers actually attack, because forging a signature is cryptographically hopeless while generating a fake identity on a key is trivial. The same logic applies when you are on the receiving end of a key you have not had time to verify, which is exactly the situation in our guide to encrypting files for someone whose key you cannot verify yet.

What the signature does not cover

Even with a perfectly bound key, a valid signature is silent about several things people assume it covers:

• The envelope. The To, From, and Subject lines you see in your client are added by mail servers and are not part of the signed content. A signed message can be forwarded, resent to a different recipient, or displayed with a misleading subject, and the signature stays valid. The signature protects the body, not the delivery.
• The time of signing. Your client shows the date it received the message. The signature itself carries no trustworthy timestamp unless the signer also used a trusted timestamping service, which almost nobody does.
• Intent. A valid signature means the key holder's software ran, not that the key holder read or agreed to the text. Malware on their machine can sign outgoing mail without them ever seeing it.
• Sole control of the key. If the private key was copied, shared with an assistant, or exfiltrated from a laptop, every signature is still technically valid. A signature cannot tell you how many machines, or people, can produce it. This is one of the quiet arguments for rotating your key on a schedule rather than keeping one until it leaks.

Where each link actually fails

Put the whole chain together and the failure modes sit at specific, checkable points:

• Digest mismatch: the message was modified in transit or by a mail provider that rewraps text. Your client will tell you. Believe it, do not click through.
• Wrong key: the signature is valid but verifies against a key you never bound to this person. This is the phishing signature, the most common attack in the wild, and the badge cannot save you from it.
• Stolen key: the binding is right and the signature is genuine, but the wrong hands hold the private key. Nothing in the math hints at this. Only out-of-band signals, like the sender confirming a recent send, catch it.
• Missing signature: unsigned mail from a correspondent who normally signs is not a technical problem, but it deserves a raised eyebrow, because an attacker stripping signatures relies on you not noticing.

A verification habit that survives all of this

None of this makes PGP signatures useless. They remain the only widely available mechanism that lets an ordinary email user detect tampering and impersonation at the content level, and used with honest expectations they are excellent. The habit that works:

1. Verify a correspondent's key fingerprint once, over a channel that is not the channel that delivered the key. A phone call, a different messenger, anything with a different attack surface.
2. Record which key you verified, so that when a second key appears for the same address, as we explain in our guide to multiple keys for one identity, you know which one earned trust and which one is a stranger.
3. Treat every signature check as two checks: does the signature verify, and is this the key I actually bound. The badge answers the first. Only you answer the second.

A signature is a statement by a key, not a statement by a person. Use it for what it proves, supply the rest yourself, and the green badge starts meaning what you always hoped it did.