Verification glossary
Each definition stands on its own and assumes none of the others have been read.
Keys
Public key. The half you share. Anybody can use it to check a signature you made or to encrypt something only you can read.
Private key. The half that never leaves your machine. Signing requires it, which is why a signature says something about who produced a message.
Fingerprint. Forty hexadecimal characters derived from a public key. Short enough for a person to compare, unique enough to stand in for the key itself.
Keyring. The local store of public keys you have collected. Importing into it implies no trust and no endorsement.
Signatures
Clearsigned. A message with its signature wrapped around it, readable without any tooling and checkable with it.
Detached signature. A separate small file that verifies another file without modifying it. The usual form for downloads.
Good signature. The result you are looking for: the content matches what was signed and the signature was made with the named key.
Bad signature. The content and the signature disagree. Either the message changed or the signature belongs to something else.
Trust and revocation
Web of trust. A social layer where people vouch for keys belonging to particular owners. Barely used in practice, and the source of the warning that stops most people mid verification.
Revocation certificate. A signed statement from a key holder that the key should no longer be trusted. Signed with the key being revoked, because only the holder can produce it.
Expiry. A date after which a key is treated as stale. Routine and frequently extended, unlike a revocation.
Addresses
Rotation. Retiring one or more addresses and publishing replacements. Maintenance rather than a warning sign.
Unsigned address. A string with nothing connecting it to the operator. Not usable regardless of where it appeared.
Two pairs that get confused
Expiry and revocation are not the same. An expiry is a date passing and is routinely extended. A revocation is a deliberate statement that a key should no longer be trusted, and it is signed with the key itself so that only the holder can issue one.\n\nA good signature and a trusted key are also different. The first says the message matches what was signed. The second is a social judgement about ownership that nobody has usually made, which is why the warning about it appears on almost every check and means nothing about the result.