Know their key is really there.
Peer-to-peer video where each person's YubiKey keeps proving it's present, tied to their GPG identity, for the whole call.
Bound to your GPG key
Your GPG key signs once to vouch for your YubiKey. Peers check it against your fingerprint.
Touch to prove presence
Every few seconds your key signs a commitment to the exact video and chat you sent.
Direct, no server
Browsers connect to each other directly. You swap two codes over any channel.
Your identity
One-time setup on this browser: your GPG key vouches for your YubiKey.
-
40 hex characters, spaces are fine
How do I find my GPG fingerprint?
- Open a terminal and run:
gpg --list-secret-keys --fingerprint
- Copy the 40-character line under
sec(your primary key), not thessbsubkeys.
- GPG Suite: open GPG Keychain, double-click your key and copy the Fingerprint.
- Homebrew (
brew install gnupg pinentry-mac): in Terminal rungpg --list-secret-keys --fingerprintand copy the 40-character line undersec.
- Kleopatra (part of Gpg4win): select your key under Certificates and copy the fingerprint from the Details pane.
- PowerShell:
gpg --list-secret-keys --fingerprintthen copy the 40-character line under
sec. Use PowerShell, notcmd.exe, for the signing step too.
Example output
sec> ed25519 2025-03-14 [SC] 4853 B8A6 AC40 E551 3372 3A1A 6554 2D79 E5A6 7972 Card serial no. = 0006 12345678 uid [ultimate] Alice Example <alice@example.com> ssb> cv25519 2025-03-14 [E]Keys on a YubiKey show as
sec>with a card serial. If nothing is listed, import your public key (gpg --import mykey.asc) and rungpg --card-statusonce so GnuPG links the card. - Open a terminal and run:
Connect to your peer
No server is involved: you swap two codes over any chat, email or text.
Read it aloud. It must be the same on their screen; if it isn't, someone may be intercepting the call.