# New Signing Key? **URL:** \ **Category:** Support\ **Created:** [January 8, 2023, 8:23pm UTC](https://bisq.community/t/new-signing-key/11853 "2023-01-08T20:23:05Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![noremote](https://bisq.community/letter_avatar/noremote/32/5_5575768a8748004e209b776fc1b2916d.png) [@noremote](https://bisq.community/u/noremote)\ **Post date:** [January 8, 2023, 8:23pm UTC](https://bisq.community/t/new-signing-key/11853/1 "2023-01-08T20:23:05Z")
I just downloaded 1.9.9 and I did not have a key to verify the signature. Did I lose the key or the key change, with no announcement? If the key changed without signing it with the old key, that’s a serious security error. But maybe I just screwed something up on my end? ---
**Author:** ![ckdc](https://bisq.community/user_avatar/bisq.community/ckdc/32/3253_2.png) [@ckdc](https://bisq.community/u/ckdc)\ **Post date:** [January 8, 2023, 8:29pm UTC](https://bisq.community/t/new-signing-key/11853/2 "2023-01-08T20:29:50Z")
Seems to me the releaser has changed, I think you can find the gpg public key on bisq.wiki ---
**Author:** ![MnM](https://bisq.community/user_avatar/bisq.community/mnm/32/257_2.png) [@MnM](https://bisq.community/u/MnM)\ **Post date:** [January 9, 2023, 8:48am UTC](https://bisq.community/t/new-signing-key/11853/3 "2023-01-09T08:48:35Z")
It changed. [Downloading and installing - Bisq Wiki](https://bisq.wiki/Downloading_and_installing#Verify_installer_file) Twitter and release notes announce that change, but no, old key has not signed the new one, they’re different owners. ---
**Author:** ![bisquicked](https://bisq.community/letter_avatar/bisquicked/32/5_5575768a8748004e209b776fc1b2916d.png) [@bisquicked](https://bisq.community/u/bisquicked)\ **Post date:** [January 9, 2023, 2:59pm UTC](https://bisq.community/t/new-signing-key/11853/4 "2023-01-09T14:59:45Z")
Looks like the wiki is missing some info, quote: " which you can verify through [commits on GitHub](https://github.com/bisq-network/bisq/commits?author=alejandrogarcia83) and []." What’s in the box?!?! ---
**Author:** ![MnM](https://bisq.community/user_avatar/bisq.community/mnm/32/257_2.png) [@MnM](https://bisq.community/u/MnM)\ **Post date:** [January 9, 2023, 11:28pm UTC](https://bisq.community/t/new-signing-key/11853/5 "2023-01-09T23:28:03Z")
Thanks, I’ve just fixed it. You could see ripcurlx key on keybase, but Bisq does not use Keybase anymore. ---
**Author:** ![noremote](https://bisq.community/letter_avatar/noremote/32/5_5575768a8748004e209b776fc1b2916d.png) [@noremote](https://bisq.community/u/noremote)\ **Post date:** [January 10, 2023, 11:22pm UTC](https://bisq.community/t/new-signing-key/11853/6 "2023-01-10T23:22:11Z")
> [@MnM](#): > > old key has not signed the new one, they’re different owners. Yes, and different owners can sign each others’ keys. That is the proper procedure when changing a signing key. The former maintainer signs the new maintainer’s key. It really does not help that it is in the release notes obviously, because anyone who could compromise the binary could compromise the release notes (they are in the same infrastructure). This is really a basic verification process error here. Of course it does not mean there is a problem, but the point of using GPG is to ensure there is not one, and Bisq is not following the procedures that allow to verify this. ---
**Author:** ![christoph](https://bisq.community/user_avatar/bisq.community/christoph/32/1252_2.png) [@christoph](https://bisq.community/u/christoph)\ **Post date:** [January 11, 2023, 8:36pm UTC](https://bisq.community/t/new-signing-key/11853/7 "2023-01-11T20:36:23Z")
I just signed and published both new signer keys. ---
**Author:** ![swidgen](https://bisq.community/letter_avatar/swidgen/32/5_5575768a8748004e209b776fc1b2916d.png) [@swidgen](https://bisq.community/u/swidgen)\ **Post date:** [January 14, 2023, 11:01am UTC](https://bisq.community/t/new-signing-key/11853/8 "2023-01-14T11:01:11Z")
is the new pgp signing key and public key up in the download section? because i tried uploading the public key yesterday and it was the same one that i’ve had for years ---
**Author:** ![Till](https://bisq.community/letter_avatar/till/32/5_5575768a8748004e209b776fc1b2916d.png) [@Till](https://bisq.community/u/Till)\ **Post date:** [January 16, 2023, 9:20am UTC](https://bisq.community/t/new-signing-key/11853/9 "2023-01-16T09:20:51Z")
Hey there! Following your (updated?) link to verify the installer, the wiki states: > Bisq installer files are currently built and signed by Alejandro Garcia (alejandrogarcia83). His public key ID is E222AA02 and fingerprint is B493 3191 06CC 3D1F 252E 19CB F806 F422 E222 AA02, which you can verify through commits on GitHub. However, the latest commits by user “alejandrogarcia83” on GitHub were signed with GPG key ID: 4AEE18F83AFDEB23; not »E222AA02«. What am I missing? ---
**Author:** ![MnM](https://bisq.community/user_avatar/bisq.community/mnm/32/257_2.png) [@MnM](https://bisq.community/u/MnM)\ **Post date:** [January 16, 2023, 9:26am UTC](https://bisq.community/t/new-signing-key/11853/10 "2023-01-16T09:26:05Z")
bisq.network key has not been uploaded yet. @till I’m asking why last commit’s key is different. ---
**Author:** ![MnM](https://bisq.community/user_avatar/bisq.community/mnm/32/257_2.png) [@MnM](https://bisq.community/u/MnM)\ **Post date:** [January 17, 2023, 3:17pm UTC](https://bisq.community/t/new-signing-key/11853/11 "2023-01-17T15:17:12Z")
Copying the reply I got from Bisq 2 repo maintainer: > That’s normal. It’s GitHub’s PGP key. Look at the Bisq 2 repo commits ([Commits · bisq-network/bisq2 · GitHub](https://github.com/bisq-network/bisq2/commits/main)). When I merge PRs using the “GitHub UI” GitHub will sign the “merge commit”. ---
**Author:** ![Till](https://bisq.community/letter_avatar/till/32/5_5575768a8748004e209b776fc1b2916d.png) [@Till](https://bisq.community/u/Till)\ **Post date:** [January 18, 2023, 8:08am UTC](https://bisq.community/t/new-signing-key/11853/12 "2023-01-18T08:08:18Z")
Thanks for taking care of it, @MnM ! Let me get this straight: In the Bisq repository, I find commits from user “alejandrogarcia83” with two different signatures: 1. his personal GPG signature: used when he does “classic” work (e.g. remote work using `git push`) 2. any GitHub GPG signature: used when he works via the GitHub WebGUI. This is not obvious to me as a user (and thus possibly to others) without explanation and leads to confusion in key verification. Is there a better way to do this? ---
**Author:** ![MnM](https://bisq.community/user_avatar/bisq.community/mnm/32/257_2.png) [@MnM](https://bisq.community/u/MnM)\ **Post date:** [January 18, 2023, 8:20am UTC](https://bisq.community/t/new-signing-key/11853/13 "2023-01-18T08:20:40Z")
From the reply I got, it seems there is no better way to do it. If at least one of the keys signed commits, and the web gives you that key, seems enough. But I understand it’s confusing. I’ll wait, though, to see if other people complains about this to see if something else is necessary. ---
**Author:** ![noremote](https://bisq.community/letter_avatar/noremote/32/5_5575768a8748004e209b776fc1b2916d.png) [@noremote](https://bisq.community/u/noremote)\ **Post date:** [January 21, 2023, 4:37am UTC](https://bisq.community/t/new-signing-key/11853/14 "2023-01-21T04:37:05Z")
> [@MnM](#): > > From the reply I got, it seems there is no better way to do it. There is a long-established way of handling exactly this sort of thing, and Bisq isn’t doing it. Why even use signing keys if you’re not going to use them in the proper way? I actually forget the original situation here, but if there are two keys then each of those keys should have signed each other and uploaded the new keys to the keyserver so everyone can verify that each signer knows the other. If there is a new key, all former signing keys need to sign the new key, and upload all to the keyservers. Also, the website should expain this situation. It is not acceptable to have a website say one thing, but the actual keys say something different. This is basic keysigning procedure. Like I said I don’t remember what this situation is but what I’ve just laid out is keysigning 101 and should cover most situations. To skip this basic security function for a piece of software that uses Tor and handles private data should be a huge red flag for anyone considering using Bisq. We’re not talking about anything special here, just basic keysigning/validation rules. ---
**Author:** ![noremote](https://bisq.community/letter_avatar/noremote/32/5_5575768a8748004e209b776fc1b2916d.png) [@noremote](https://bisq.community/u/noremote)\ **Post date:** [April 17, 2024, 1:34am UTC](https://bisq.community/t/new-signing-key/11853/15 "2024-04-17T01:34:54Z")
> [@MnM](#): > > I’ll wait, though, to see if other people complains about this to see if something else is necessary. Hopefully by now you’ve seen that this is a problem? There is a proper way to start using a new key. Among other things, you sign the new key with the old key. You also give a clear and good reason, and state it publicly. Otherwise you end up in a situation where there are always questions about the software from that point on. It’s crazy that Bisq developers don’t understand this, it’s alongside the most basic of rules when using GPG/PGP, but at least the Whonix team does: www whonix org/wiki/Bisq#cite\_ref-6: > **[Bisq: The P2P Exchange Network](https://www.whonix.org/wiki/Bisq#cite_ref-6)** > > How to use Bisq - The P2P Exchange Network - in Whonix