If you want to reach me about something sensitive — a security report, a private question, a piece of feedback you’d rather not have on a public issue tracker — the footer of every page on this site links to my PGP public key. This post walks through how to actually use it.

The key, at a glance

Always verify the fingerprint out-of-band before trusting a key — for example by checking it against a post I’ve signed on another channel, or by asking me in person. Key IDs are short and can be spoofed; the full 40-character fingerprint is the thing that matters.

One-time setup: import the key

If you have gpg installed (you almost certainly do on Linux or macOS; on Windows, Gpg4win is the standard), grab the key from this site and import it:

curl -sSfL https://shubxam.in/shubham-soni-public.txt | gpg --import

Then verify what you got. The fingerprint is the thing to check:

gpg --fingerprint 5969C3E6B3909F0B

The output should end with the same 707D 27BB ADCE 4F68 CD88 0E18 5969 C3E6 B390 9F0B fingerprint shown above. If it doesn’t, stop here — don’t send anything yet.

A quick “did I import the right key” check:

gpg --list-keys --keyid-format=long shubxam@gmail.com

You should see one pub entry for ed25519/5969C3E6B3909F0B with the user ID shubham soni <shubxam@gmail.com>.

Send me an encrypted email

The simplest path: write the message in a file, encrypt it to my key, then attach the resulting .gpg file to a regular email (or paste the body inline if it’s short).

# Write your message
cat > message.txt <<'EOF'
Hi Shubham,

[your message here]

— your name
EOF

# Encrypt to my public key. --armor makes it text-safe so you can paste
# the result into an email body if you want.
gpg --output message.gpg --encrypt --armor \
    --recipient 5969C3E6B3909F0B \
    message.txt

Attach message.gpg to an email to shubxam@gmail.com. I’ll decrypt it locally with my private key and reply.

Or, encrypt to my key directly from your mail client

Most modern mail clients can do this once the key is imported. A few common ones:

• Thunderbird has built-in OpenPGP support. Go to Account Settings → End-to-End Encryption → Add Key → select the imported key for shubxam@gmail.com, then click the lock icon in the compose window.
• mutt / neomutt with pgp_gpg_sign_as and pgp_encrypt_only_command configured can encrypt on send.
• Apple Mail with GPG Mail or GPGTools.

If your mail client doesn’t have native PGP, the file-attach flow above works from anything.

Things to keep in mind

• PGP encrypts the message body, not the metadata. The email’s To:, From:, subject, and timestamps are still visible to your and my mail provider. Subject lines are the most-leaky bit — leave them empty, or write something uninformative.
• My private key never leaves my laptop. Even if my email account is compromised, an attacker can’t read past messages — only ones I receive from that point forward.
• This is not a substitute for Signal / Matrix / etc. for real-time conversation. PGP is best for asynchronous, written, non-urgent messages.
• The key is signed with a “testing” sub-UID (you’ll see it if you run gpg --list-keys and look carefully). The primary UID is the one above. Tools like gpg and Thunderbird will pick the primary UID by default; the testing UID is marked as revoked and is harmless.

If you want to verify the key over another channel

The strongest form of verification is to compare the fingerprint out-of-band. A few options:

• I publish the same fingerprint on my Mastodon profile, signed with the same key.
• I can show you the fingerprint on a video call.
• If you’re in the same room as me: just ask.

Once you’ve verified, you can sign my key with your own:

gpg --sign-key 5969C3E6B3909F0B

…and send me the signed key (or upload it to a keyserver) so future correspondents can build a web of trust.

That’s it

A single gpg --import, a single gpg --encrypt, attach the file, send. The whole thing takes about a minute if you already have gpg installed, and the privacy upside is real for anything you don’t want sitting unencrypted on a mail server.

If the key ever rotates, the next version of this post will say so at the top and the key file itself will be the source of truth.

If something here is wrong or out of date, open an issue or — better — send me a PGP-signed patch.