Hello,

Thanks for this interesting post.

I am considering verify Electrum with your method. I have read carefully your tutorial but I still need to start the process.

I am a Mac user and I had several questions :
-I have already downloaded Electrum (from the original website : electrum.org) --> Do I have to uninstall Electrum and install it again after installing GPG, generate private key (I am not sure to understand the reason of the private key either) and Imprt ThomasV's PGP Key on MacOS ? Or I can verify Electrum while it's already on my MacOS ?
-For info, I am using the Electrum version 4.2.1[/quote/]

The version of Electrum isn't important, the method I described works for v4.2.1 and should work for future releases as well.  You don't need to uninstall Electrum to verify the .dmg file.  You just need to download the .asc signature file associated with the .dmg file, and run the verification method.  If it passes then you know the software you've already installed is authentic.  If it doesn't pass verification, then you should definitely purge the installation.  Personally, I would purge the entire system, but I'm paranoid.



Yes, those are trusted sources for ThomasV's key.  The easiest way to save the key is by copying the text from that first link, and pasting it into your favorite text editor.  You can then save it on your system with the name that you choose.  The name of the file isn't important, but remember where you saved it so that you can browse back to that location while importing into your GPG app.