AWazonmirror directory
Copy an address

The key the market signs with

Awazon Market publishes a PGP key and signs its mirror list with it. A signature that verifies against the fingerprint below means the list you are holding was really written by the market, not by whoever wanted you to open it. The key is from February 2025 and has been in use since the market’s launch.

2B76 EB1A E895 09D4 0839 AD60 12C8 2C28 65D7 7D55Fingerprint of the Awazon Market public key (RSA 4096, created 2025-02-21). When in doubt about any key, compare this line first.
The full public key
-----BEGIN PGP PUBLIC KEY BLOCK----- mQINBGe5BuABEACxN/dtAlDF2p6SK+cR9TN+XQIx1HJPAAAESIgbDRQdWWmcpphK bMVMDyCk2POoDy9n3RZ9UtCLDQRYcadDjz7EHLIKFYIzJK0ZUHw9PuuNGxTzvfKj FKvd4N6uGWn4V5aGYY8lzSFvlheWoLOjylhy3XIYoMiVh2bE6NdEvBkxGkvF2RVP ILQyqeqiyCdSXq/AsCBeOEZ8YI9zkwmlr/szb5nQLlZk1iFzGh7QHue9Bit+z8fo 25opCzoteeIaQ3vAA8+lorkZ8lEkVBE3O6MWrDUvD3dk5b8aB+hngP9y899TcZeD 0ve9IO7oT2egquTCxjcSnNtP8HRP+CK7j4PYZtk6t9Mitjc1J2MMAt4CxSl3e4So YqptEWQ9k70vx1ehlPzAjpJMNQYWOStEgouXsriqsN1G/ZVPf2JZlGfFqSuvhG2f y+fZSpE6S4t7+Vz9S0XjNwy9PTK0tMb/Vl5RmReDb3ZhsIDNVvC5k6GPRIi+4H2j 9CcHSbC0O1I39ak6DLG2/AZXKN7p4RQAJCHKrKdwyN66qxpz1FiQ2wPS5fbXOexr ZN1WA+ivNkzFrgZvIfpvm89GH2Vw8TPxokKUZfqrsjvFjtnIdehwdHwuG8D1WjKw 8eqQwSYO8nSlZoeFE2edMigj04ZWvdEUKYt5k2IsWtqCsUtHtpUtYlqgdQARAQAB tB1Bd2F6b24gTWFya2V0IDxmdWNrQG5vbmUuY29tPokCTgQTAQoAOBYhBCt26xro lQnUCDmtYBLILChl131VBQJnuQbgAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA AAoJEBLILChl131VJa4QAKBeAgULnjOMH1emTf3DVHD5YfqqIZjv1jQd/+fxV5ax j4kjODFq1lMIiZ6AeSzDJ7u/xPVJg8fXUvEnlUWMRVjyedAiCrkeKqzHDeYSgHe/ 6M4JBbJZo67+1CMuEMecWVGhI/EM0V9eaZnJ3E02FvURTgI8ZwATzO1c4ENZUbkx kBgobbCD6gmY+utn1+taojLErrO+NQgFPeh2O6MXXkHHV5bNC0gm3GTTlUUGZXC6 EYWmQrRyKhXwkDWk3heLWlwhkEtbAd9AHVn4XItA9gyLwiWJX7Ek+cx/utwa07sa aFoopfWUM1HrDVOSz/h/9AgFIkkVohqIH4VWP9euWWnHrn+rhdi6EBBS8wUU9ldS 3zztKOuEwd2PAwnTTUa1zTsEUAoNZH+EyLLoaJ2wfXNJU9P7b2wHl6gdiVDrf/eJ ZnLBaw6gG3TXQFVHSF2k75ylobJgQFqsMIFrgqZpKe6dCQK9BwXjbZKLJx0Gc47x oHUaIT0AmYYsdCQV0o7wdYaHFz4L2sqCEpQLTJdNpTuBgd7Errr2jBM0SD2okSOv xGwVF6vb0ya2uvZrinTPHIosgjCzT+IXXpK7QTXHJnRmIOep3O861DuuNFs5stf9 afeqhZicFBNc3Q8LRyldGfH0Xys57UP0QV82deowhxtBYXzd0pCg6tXEd5t+lGzS uQINBGe5BuABEADFsT1c6KYlkal3KOOmNxhvUlR2jzcUmcRWb8eqvNV1FHbTEZC1 T3lcYyNSz+DNzs58CV9RJIbjjElQEGVvOGZr70YxL+0Q+PqDKo328+ZLhgfuOuhI 8hvV1HYk6zmFWC2F7xzMPyaaIk3wd/fMDG2sgphdibOJ4mHu0Zqa8GSI5lyU5tEs JGOGSsY61QSWaVSYW6YP2X4RxSYT8aadSPohnAQga5Mqv960ZE0a/sVy0DStMFdu BM9IIkB2RaeW2Yxp+koqW+4aVB37hJVYXwGjHETEJlTeo3e5tJpY7iXYQrvRbE0W JG8GpwfWAKwV6wPQE/rXmjNQd7osQPHKAC5zrQPzYObmmw182s5s/84iANkUpxxL Upw5I8XMT4CqMxu6UxeMaJ0DHZRax9mfV/x9R6of6nam7SCg6sS0DhxgefU6x8UL GTFKFkhcdlNlC7CfFgCoIxMQGGLyomo4RXXrFklCG9oSvCbvyEhHqJ1nqdNOF59N CRP6rBrcLLaHrGvoY/zaJSwrPuV/8Toxk5RZ2QBZKgHCTkwvXwFzDIlGy2htBBiw JVScxWr0UB9SExKwfyda7Hd6lyEl/L8sXm6K2s+G6RG2/Q/m1QsVp8iQIgP04MZo q1SHqdFL5+ld7Zg2y4CFFybMw4r/5VwWwIKhufOC5YIjNfCBUylajuDhiQARAQAB iQI2BBgBCgAgFiEEK3brGuiVCdQIOa1gEsgsKGXXfVUFAme5BuACGwwACgkQEsgs KGXXfVWQJQ//RATFrZCLX6NRJsw5gRPiADU1nwR/PTqK8PklgPSD2F+FyWWzWA9r PJ0sAtAn9ONV+KYSJq/UOYhciYNcD1QvpMn6se/avNQUZ+D2FKrnDycOzI0hdyW/ 1hY48hu8VtxRwJNVKAs+kPse70qa+QynMMm4p4GWHkkGwR0idBgLHgd27d2Qer+g WZvPqjzwZoY4xb7kmGbPeBHL4jkvJ6yhyu3vv61rtxBgkbEgm/HTOK3LH1/SJdGR S03olUXxugH1ycSCYIFE/NQzQZFTSxdnZP2y924YFoYUzcy5d+WqRJ6DQwINxMPX sHRxd64jU97FdliyyMmfvM7Sg20cG45zu2tTDdpUX7LV33TZAOmAo6tlb256jIKg 1gkBEteuNw90t+KvUFd0CIrnKA4MbbbjaNEnqw8dNpR/SlPk18RFT5P7UwUt6fwr sBl9KRCoxSzC+WZcuhzAL0xHivvc0J1qBeP8INGjSGEdjDQ+EafmLu6EUQeto8yX ahH8FB2xf+hojx0nfZw6RFd5G5VF4rUSWlPLjjQMSwhwlx7xHq8XwrH32i5PvNRa vpU+ohb94oorQGY/mE5gq288e9Qe/1LXlkAP0VLM0El6onPQIUyV9YnI5Jjveufx MbM6xcrIac/XXN/Pf904uXpp4Qb/Js/DzNSmA7I/YxZJfvSFRCaEIWE= =dOxl -----END PGP PUBLIC KEY BLOCK-----

How to verify a signed mirror list

  1. Import the keyCopy the block above into a file, for example awazon.asc, and run gpg --import awazon.asc. On Windows, Gpg4win imports the same file; on a Mac, GPG Suite does. Once it is imported, the fingerprint line above should match what the tool shows you. If it does not match, delete the key and start over.
  2. Get the signed listThe market publishes its mirror list as a short PGP-signed text: the addresses, followed by a signature block. It appears on the market’s official channels. Keep the whole message, signature included, in a text file. A signature without the text it signs is nothing.
  3. VerifyRun gpg --verify mirrors.txt. GnuPG will tell you whether the signature is good and which key made it.
  4. Read the resultYou want “Good signature” from the Awazon Market key, and the key’s fingerprint should read 2B76 EB1A E895 09D4 0839 AD60 12C8 2C28 65D7 7D55. That is the check. The addresses in the list are then the real ones, and you can open any of them with confidence.

What a bad signature means

“BAD signature” means one of two things: the list was changed after it was signed, or it was never signed by this key in the first place. Either way, the list is not safe to trust. Do not open the addresses in it and do not reuse the key you imported if the fingerprint did not match. The good signature is the whole point of the exercise; without it you are back to checking characters by hand, which the address check page covers.

Without GnuPG installed

Any of the standard key viewers will do the same verification: Gpg4win on Windows, GPG Suite on macOS, or Kleopatra on Linux. All of them import the file, show you the fingerprint to compare, and run the verify step. The command line is faster for a one-off; the GUI is friendlier if you will be checking lists more than once.