# I am the Watcher. I am your guide through this vast new twtiverse.
# 
# Usage:
#     https://watcher.sour.is/api/plain/users              View list of users and latest twt date.
#     https://watcher.sour.is/api/plain/twt                View all twts.
#     https://watcher.sour.is/api/plain/mentions?uri=:uri  View all mentions for uri.
#     https://watcher.sour.is/api/plain/conv/:hash         View all twts for a conversation subject.
# 
# Options:
#     uri     Filter to show a specific users twts.
#     offset  Start index for quey.
#     limit   Count of items to return (going back in time).
# 
# twt range = 1 108
# self = https://watcher.sour.is/conv/f7rdmuq
Anyone here good with Go and feel like helping me build our a "Direct Messages" feature? I was going to pay someone on Upwork to do this, but I've received very few applicants (_just one!_) and they aren't that good (_stock standard crappy Bootstrap experience and no evidence of any experience with Go_).
Anyone here good with Go and feel like helping me build our a "Direct Messages" feature? I was going to pay someone on Upwork to do this, but I've received very few applicants (_just one!_) and they aren't that good (_stock standard crappy Bootstrap experience and no evidence of any experience with Go_).
@prologic I'm tight on cash and would like to learn some Go, but don't have much experience with it. ๐Ÿ˜›
@prologic I'm tight on cash and would like to learn some Go, but don't have much experience with it. ๐Ÿ˜›
@prologic I'm tight on cash and would like to learn some Go, but don't have much experience with it. ๐Ÿ˜›
If _only_ I had a way to privately message you ๐Ÿค” I'm willing to fork out a few ๐Ÿ’ต for someone to help, my RSI is getting quite bad nowadays ๐Ÿ˜ข Writing Go isn't all that hard and this is pretty simple stuff really, for a PoC I'm just going to borrow from something like what Lobsters does and worry about e2e crypto later (_Goal: privacy from Pod Owner's prying eyes, not necessarily NSA-proof messaging ๐Ÿ˜‹_) PM me on FreeNode if you like prologic or mail me at james ๏ผ  mills ยท io_
If _only_ I had a way to privately message you ๐Ÿค” I'm willing to fork out a few ๐Ÿ’ต for someone to help, my RSI is getting quite bad nowadays ๐Ÿ˜ข Writing Go isn't all that hard and this is pretty simple stuff really, for a PoC I'm just going to borrow from something like what Lobsters does and worry about e2e crypto later (_Goal: privacy from Pod Owner's prying eyes, not necessarily NSA-proof messaging ๐Ÿ˜‹_) PM me on FreeNode if you like prologic or mail me at james ๏ผ  mills ยท io_
If _only_ I had a way to privately message you ๐Ÿค” I'm willing to fork out a few ๐Ÿ’ต for someone to help, my RSI is getting quite bad nowadays ๐Ÿ˜ข Writing Go isn't all that hard and this is pretty simple stuff really, for a PoC I'm just going to borrow from something like what Lobsters does and worry about e2e crypto later (_Goal: privacy from Pod Owner's prying eyes, not necessarily NSA-proof messaging ๐Ÿ˜‹_) PM me on FreeNode if you like prologic or mail me at james ๏ผ  mills ยท io_
This is what I have done so far...\n\n \n\nAnd:\n\n
This is what I have done so far...\n\n \n\nAnd:\n\n
This is what I have done so far...



And:

This is what I have done so far...



And:

@prologic ๐Ÿ‘‹ I can take a stab at it when I am done with the changes I am working on.
@prologic ๐Ÿ‘‹ I can take a stab at it when I am done with the changes I am working on.
@prologic ๐Ÿ‘‹ I can take a stab at it when I am done with the changes I am working on.
@prologic ๐Ÿ‘‹ I can take a stab at it when I am done with the changes I am working on.
@xuu Oh that would be nice! I think @adi has volunteered as well. Basically let's get a first version working that _actually works_โ„ข ๐Ÿ˜€
@xuu Oh that would be nice! I think @adi has volunteered as well. Basically let's get a first version working that _actually works_โ„ข ๐Ÿ˜€
@xuu Oh that would be nice! I think @adi has volunteered as well. Basically let's get a first version working that _actually works_โ„ข ๐Ÿ˜€
i am guessing you are using some form of webmention to notify the target of the DM? which loads it into a store for the user to read?
i am guessing you are using some form of webmention to notify the target of the DM? which loads it into a store for the user to read?
i am guessing you are using some form of webmention to notify the target of the DM? which loads it into a store for the user to read?
i am guessing you are using some form of webmention to notify the target of the DM? which loads it into a store for the user to read?
@prologic for encryption. we can have browser/app generate ec25519 keypair. store the private on device and add pub to list of devices for the user on pod.
@prologic for encryption. we can have browser/app generate ec25519 keypair. store the private on device and add pub to list of devices for the user on pod.
@prologic for encryption. we can have browser/app generate ec25519 keypair. store the private on device and add pub to list of devices for the user on pod.
@prologic for encryption. we can have browser/app generate ec25519 keypair. store the private on device and add pub to list of devices for the user on pod.
@prologic sender generates an AES key encrypts message. gets the device list for user and encrypts key for each device. sends the encryptedkeys+cypertext.
@prologic sender generates an AES key encrypts message. gets the device list for user and encrypts key for each device. sends the encryptedkeys+cypertext.
@prologic sender generates an AES key encrypts message. gets the device list for user and encrypts key for each device. sends the encryptedkeys+cypertext.
@prologic sender generates an AES key encrypts message. gets the device list for user and encrypts key for each device. sends the encryptedkeys+cypertext.
@prologic device gets the cypertext and uses it's device key to decrypt one of the keys and then decrypts the cypertext.
@prologic device gets the cypertext and uses it's device key to decrypt one of the keys and then decrypts the cypertext.
@prologic device gets the cypertext and uses it's device key to decrypt one of the keys and then decrypts the cypertext.
@prologic device gets the cypertext and uses it's device key to decrypt one of the keys and then decrypts the cypertext.
@prologic pod should probably track revocation of device keys and delete the encryptedkeys that are paired with revoked keys
@prologic pod should probably track revocation of device keys and delete the encryptedkeys that are paired with revoked keys
@prologic pod should probably track revocation of device keys and delete the encryptedkeys that are paired with revoked keys
@prologic pod should probably track revocation of device keys and delete the encryptedkeys that are paired with revoked keys
@prologic def would be a wider discussion on preventing the pod from adding its own key to a users device list. Or using device keys to authenticate instead of user/pass.
@prologic def would be a wider discussion on preventing the pod from adding its own key to a users device list. Or using device keys to authenticate instead of user/pass.
@prologic def would be a wider discussion on preventing the pod from adding its own key to a users device list. Or using device keys to authenticate instead of user/pass.
@prologic def would be a wider discussion on preventing the pod from adding its own key to a users device list. Or using device keys to authenticate instead of user/pass.
> i am guessing you are using some form of webmention to notify the target of the DM? which loads it into a store for the user to read?

No webmention(s) are only used to perform an internal event on a pod that causes the @twtxt bot to post about it.
> i am guessing you are using some form of webmention to notify the target of the DM? which loads it into a store for the user to read?

No webmention(s) are only used to perform an internal event on a pod that causes the @twtxt bot to post about it.
> i am guessing you are using some form of webmention to notify the target of the DM? which loads it into a store for the user to read?\n\nNo webmention(s) are only used to perform an internal event on a pod that causes the @twtxt bot to post about it.
> i am guessing you are using some form of webmention to notify the target of the DM? which loads it into a store for the user to read?\n\nNo webmention(s) are only used to perform an internal event on a pod that causes the @twtxt bot to post about it.
@xuu @prologic But if I get a new device, how can I read my old messages?
@xuu @prologic But if I get a new device, how can I read my old messages?
@xuu @prologic But if I get a new device, how can I read my old messages?
@xuu re encryption, that sounds reasonable actually. But instead of AES, let's use Salt/NaCL. I put together this library and tool which uses ED25519 for your "device key pair" / or "identity key pair" and uses Curve25519, Salsa20, and Poly1305 for the actual encryption (_normal box.Seal()_). The only downside at the moment is single recipient only (_I borrowed most of this code from someone else_). But this lets us use TweetNaCL
@xuu re encryption, that sounds reasonable actually. But instead of AES, let's use Salt/NaCL. I put together this library and tool which uses ED25519 for your "device key pair" / or "identity key pair" and uses Curve25519, Salsa20, and Poly1305 for the actual encryption (_normal box.Seal()_). The only downside at the moment is single recipient only (_I borrowed most of this code from someone else_). But this lets us use TweetNaCL
@xuu re encryption, that sounds reasonable actually. But instead of AES, let's use Salt/NaCL. I put together this library and tool which uses ED25519 for your "device key pair" / or "identity key pair" and uses Curve25519, Salsa20, and Poly1305 for the actual encryption (_normal box.Seal()_). The only downside at the moment is single recipient only (_I borrowed most of this code from someone else_). But this lets us use TweetNaCL
@adi @xuu I'm not sure this is something we can solve. The same problem exists with Signal, GPG and _ptobabpy_ any other kind of public key crypto protocol/system. If you lose your keys, you can no longer read old messages.
@adi @xuu I'm not sure this is something we can solve. The same problem exists with Signal, GPG and _ptobabpy_ any other kind of public key crypto protocol/system. If you lose your keys, you can no longer read old messages.
@adi @xuu I'm not sure this is something we can solve. The same problem exists with Signal, GPG and _ptobabpy_ any other kind of public key crypto protocol/system. If you lose your keys, you can no longer read old messages.
@xuu

> def would be a wider discussion on preventing the pod from adding its own key to a users device list

Can we not have clients sign their own public keys before listing them on their Pod's account?
@xuu\n\n> def would be a wider discussion on preventing the pod from adding its own key to a users device list\n\nCan we not have clients sign their own public keys before listing them on their Pod's account?
@xuu

> def would be a wider discussion on preventing the pod from adding its own key to a users device list

Can we not have clients sign their own public keys before listing them on their Pod's account?
@xuu\n\n> def would be a wider discussion on preventing the pod from adding its own key to a users device list\n\nCan we not have clients sign their own public keys before listing them on their Pod's account?
@prologic
> Can we not have clients sign their own public keys before listing them on their Podโ€™s account?

Yeah.. we probably could. when they setup an account they create a master key that signs any subsequent keys. or chain of signatures like keybase does.
@prologic \n> Can we not have clients sign their own public keys before listing them on their Podโ€™s account?\n\nYeah.. we probably could. when they setup an account they create a master key that signs any subsequent keys. or chain of signatures like keybase does.
@prologic \n> Can we not have clients sign their own public keys before listing them on their Podโ€™s account?\n\nYeah.. we probably could. when they setup an account they create a master key that signs any subsequent keys. or chain of signatures like keybase does.
@prologic
> Can we not have clients sign their own public keys before listing them on their Podโ€™s account?

Yeah.. we probably could. when they setup an account they create a master key that signs any subsequent keys. or chain of signatures like keybase does.
@prologic
> Can we not have clients sign their own public keys before listing them on their Podโ€™s account?

Yeah.. we probably could. when they setup an account they create a master key that signs any subsequent keys. or chain of signatures like keybase does.
@prologic Ok.. so using NaCL boxes. yeah its just a combo of using secretbox with a generated key/nonce. and then using the pubkey box to encrypt the key/nonce for each device.
@prologic Ok.. so using NaCL boxes. yeah its just a combo of using secretbox with a generated key/nonce. and then using the pubkey box to encrypt the key/nonce for each device.
@prologic Ok.. so using NaCL boxes. yeah its just a combo of using secretbox with a generated key/nonce. and then using the pubkey box to encrypt the key/nonce for each device.
@prologic Ok.. so using NaCL boxes. yeah its just a combo of using secretbox with a generated key/nonce. and then using the pubkey box to encrypt the key/nonce for each device.
Yup pretty much. It's all supported in cryptutils and it _should_ be easy to port the same code _verbatim_ using TweetNaCL; which should then work nicely on the Web App (_client-side_) and Mobile App (_using Flutter_)
Yup pretty much. It's all supported in cryptutils and it _should_ be easy to port the same code _verbatim_ using TweetNaCL; which should then work nicely on the Web App (_client-side_) and Mobile App (_using Flutter_)
Yup pretty much. It's all supported in cryptutils and it _should_ be easy to port the same code _verbatim_ using TweetNaCL; which should then work nicely on the Web App (_client-side_) and Mobile App (_using Flutter_)
@xii Alternatively we can decide that "group messages" are out-of-scope and then we don't have to do any extra work, the salt CLI tool in cryptutils _already_ does all the work we need. We just use the same functions and target multiple device public keys. If you install the CLI we can even do this over Twtxt to see how it plays out? :)
@xii Alternatively we can decide that "group messages" are out-of-scope and then we don't have to do any extra work, the salt CLI tool in cryptutils _already_ does all the work we need. We just use the same functions and target multiple device public keys. If you install the CLI we can even do this over Twtxt to see how it plays out? :)
@xii Alternatively we can decide that "group messages" are out-of-scope and then we don't have to do any extra work, the salt CLI tool in cryptutils _already_ does all the work we need. We just use the same functions and target multiple device public keys. If you install the CLI we can even do this over Twtxt to see how it plays out? :)
I _would_ need an out-of-band way to verify your public key's fingerprint though ๐Ÿคฃ
I _would_ need an out-of-band way to verify your public key's fingerprint though ๐Ÿคฃ
I _would_ need an out-of-band way to verify your public key's fingerprint though ๐Ÿคฃ
For example, this is for @adi :\n\n
\n-----BEGIN CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----\nM3QAfkSbutLPe58ALjY+ENO8kbpjne3EjXVu9kIivl0thk2hRqcL/ZhBkQBxivh6\nJXS507BO26UbUDz0vd2xGMl8TN/EcWNVtm4PGyTPh+BOolKTy+UR0d1++ZeXc2P4\n3TvaT9aV5eShx7gMps4TmNkcOGwSwLtBHxKicwkAj9Ox7f5EHdGnDQzAOJAW69c/\ns3iAdSIDdXgcumzy+LSg+QaDWdV4SEGhcpA9Ka+TNXbGzOIJ6oDk6P8wFk6JnwRR\nu+A=\n-----END CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----\n
For example, this is for @adi :


-----BEGIN CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----
M3QAfkSbutLPe58ALjY+ENO8kbpjne3EjXVu9kIivl0thk2hRqcL/ZhBkQBxivh6
JXS507BO26UbUDz0vd2xGMl8TN/EcWNVtm4PGyTPh+BOolKTy+UR0d1++ZeXc2P4
3TvaT9aV5eShx7gMps4TmNkcOGwSwLtBHxKicwkAj9Ox7f5EHdGnDQzAOJAW69c/
s3iAdSIDdXgcumzy+LSg+QaDWdV4SEGhcpA9Ka+TNXbGzOIJ6oDk6P8wFk6JnwRR
u+A=
-----END CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----
For example, this is for @adi :\n\n
\n-----BEGIN CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----\nM3QAfkSbutLPe58ALjY+ENO8kbpjne3EjXVu9kIivl0thk2hRqcL/ZhBkQBxivh6\nJXS507BO26UbUDz0vd2xGMl8TN/EcWNVtm4PGyTPh+BOolKTy+UR0d1++ZeXc2P4\n3TvaT9aV5eShx7gMps4TmNkcOGwSwLtBHxKicwkAj9Ox7f5EHdGnDQzAOJAW69c/\ns3iAdSIDdXgcumzy+LSg+QaDWdV4SEGhcpA9Ka+TNXbGzOIJ6oDk6P8wFk6JnwRR\nu+A=\n-----END CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----\n
For example, this is for @adi :


-----BEGIN CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----
M3QAfkSbutLPe58ALjY+ENO8kbpjne3EjXVu9kIivl0thk2hRqcL/ZhBkQBxivh6
JXS507BO26UbUDz0vd2xGMl8TN/EcWNVtm4PGyTPh+BOolKTy+UR0d1++ZeXc2P4
3TvaT9aV5eShx7gMps4TmNkcOGwSwLtBHxKicwkAj9Ox7f5EHdGnDQzAOJAW69c/
s3iAdSIDdXgcumzy+LSg+QaDWdV4SEGhcpA9Ka+TNXbGzOIJ6oDk6P8wFk6JnwRR
u+A=
-----END CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----
@prologic I use https://key.sour.is/id/me@sour.is

> I would need an out-of-band way to verify your public keyโ€™s fingerprint though ๐Ÿคฃ
@prologic I use https://key.sour.is/id/me@sour.is

> I would need an out-of-band way to verify your public keyโ€™s fingerprint though ๐Ÿคฃ
@prologic I use https://key.sour.is/id/me@sour.is\n\n> I would need an out-of-band way to verify your public keyโ€™s fingerprint though ๐Ÿคฃ
@prologic I use https://key.sour.is/id/me@sour.is

> I would need an out-of-band way to verify your public keyโ€™s fingerprint though ๐Ÿคฃ
@prologic I use https://key.sour.is/id/me@sour.is\n\n> I would need an out-of-band way to verify your public keyโ€™s fingerprint though ๐Ÿคฃ
@prologic Can't decrypt that. ๐Ÿ˜›
@prologic Can't decrypt that. ๐Ÿ˜›
@prologic Can't decrypt that. ๐Ÿ˜›
@adi What about this?


-----BEGIN CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----
HNVAUkSQ/sRljsRENHzBW8xF81kKVaZ4xzixRrOfIU3ZzsURSfcik8ObodK8LF3m
4rsdUrL7JpbE0v7wvHm6YmpwPByvAtHGJQO1kQ/TcWHfrBex+yL1VmN8xS7HhfSb
H85D8Ge6CuaXSWerjTz1LHo7dYk1o1Y83f7MGrjDJgghWA6uPMn660GOk73DbUaA
HCQo0w3fiolLL5Y=
-----END CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----
@adi What about this?


-----BEGIN CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----
HNVAUkSQ/sRljsRENHzBW8xF81kKVaZ4xzixRrOfIU3ZzsURSfcik8ObodK8LF3m
4rsdUrL7JpbE0v7wvHm6YmpwPByvAtHGJQO1kQ/TcWHfrBex+yL1VmN8xS7HhfSb
H85D8Ge6CuaXSWerjTz1LHo7dYk1o1Y83f7MGrjDJgghWA6uPMn660GOk73DbUaA
HCQo0w3fiolLL5Y=
-----END CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----
@adi What about this?\n\n
\n-----BEGIN CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----\nHNVAUkSQ/sRljsRENHzBW8xF81kKVaZ4xzixRrOfIU3ZzsURSfcik8ObodK8LF3m\n4rsdUrL7JpbE0v7wvHm6YmpwPByvAtHGJQO1kQ/TcWHfrBex+yL1VmN8xS7HhfSb\nH85D8Ge6CuaXSWerjTz1LHo7dYk1o1Y83f7MGrjDJgghWA6uPMn660GOk73DbUaA\nHCQo0w3fiolLL5Y=\n-----END CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----\n
@adi What about this?\n\n
\n-----BEGIN CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----\nHNVAUkSQ/sRljsRENHzBW8xF81kKVaZ4xzixRrOfIU3ZzsURSfcik8ObodK8LF3m\n4rsdUrL7JpbE0v7wvHm6YmpwPByvAtHGJQO1kQ/TcWHfrBex+yL1VmN8xS7HhfSb\nH85D8Ge6CuaXSWerjTz1LHo7dYk1o1Y83f7MGrjDJgghWA6uPMn660GOk73DbUaA\nHCQo0w3fiolLL5Y=\n-----END CRYPTUTIL SIGNED AND ENCRYPTED MESSAGE-----\n
@prologic Same, can't decrypt it.
@prologic Same, can't decrypt it.
@prologic Same, can't decrypt it.
@xuu @prologic This? Fingerprint: 161c614f08e4ed4d1c8e5410f8c457e6878574dbab7c9ac25d474de67db1bdad
@xuu @prologic This? Fingerprint: 161c614f08e4ed4d1c8e5410f8c457e6878574dbab7c9ac25d474de67db1bdad
@xuu @prologic This? Fingerprint: 161c614f08e4ed4d1c8e5410f8c457e6878574dbab7c9ac25d474de67db1bdad
@xuu @prologic This? Fingerprint: 161c614f08e4ed4d1c8e5410f8c457e6878574dbab7c9ac25d474de67db1bdad
@xuu Looks legit :)
@xuu Looks legit :)
@xuu Looks legit :)
@xuu I _guess _ I need your public key salt -export - ๐Ÿ˜€

Here's mine:


-----BEGIN CRYPTUTIL VERIFIED KEY-----
MIHMBEBS3sgNEUEhGu8K7pgxT0b4cRpxdlRhteO8ZEsMawvJe7snRFMNThuOKnZo
MEc+VvTOeLYGiw1ZFG6XbY9WyvQcBEBS3sgNEUEhGu8K7pgxT0b4cRpxdlRhteO8
ZEsMawvJe7snRFMNThuOKnZoMEc+VvTOeLYGiw1ZFG6XbY9WyvQcAgRf1h2qBECA
lBBT/KRNLYmcD8YZAkb8DoEA/IdiH+0RmIDNPM87TVYme8rJ/8UGssPL4IX/1s+m
7J6dL0izLNuVaANEDsgF
-----END CRYPTUTIL VERIFIED KEY-----


And emailed you (_out-of-band_) the key's fingerprint for you to confirm/match :D

salt -u -import - to import
@xuu I _guess _ I need your public key salt -export - ๐Ÿ˜€\n\nHere's mine:\n\n
\n-----BEGIN CRYPTUTIL VERIFIED KEY-----\nMIHMBEBS3sgNEUEhGu8K7pgxT0b4cRpxdlRhteO8ZEsMawvJe7snRFMNThuOKnZo\nMEc+VvTOeLYGiw1ZFG6XbY9WyvQcBEBS3sgNEUEhGu8K7pgxT0b4cRpxdlRhteO8\nZEsMawvJe7snRFMNThuOKnZoMEc+VvTOeLYGiw1ZFG6XbY9WyvQcAgRf1h2qBECA\nlBBT/KRNLYmcD8YZAkb8DoEA/IdiH+0RmIDNPM87TVYme8rJ/8UGssPL4IX/1s+m\n7J6dL0izLNuVaANEDsgF\n-----END CRYPTUTIL VERIFIED KEY-----\n
\n\nAnd emailed you (_out-of-band_) the key's fingerprint for you to confirm/match :D\n\nsalt -u -import - to import
@xuu I _guess _ I need your public key salt -export - ๐Ÿ˜€\n\nHere's mine:\n\n
\n-----BEGIN CRYPTUTIL VERIFIED KEY-----\nMIHMBEBS3sgNEUEhGu8K7pgxT0b4cRpxdlRhteO8ZEsMawvJe7snRFMNThuOKnZo\nMEc+VvTOeLYGiw1ZFG6XbY9WyvQcBEBS3sgNEUEhGu8K7pgxT0b4cRpxdlRhteO8\nZEsMawvJe7snRFMNThuOKnZoMEc+VvTOeLYGiw1ZFG6XbY9WyvQcAgRf1h2qBECA\nlBBT/KRNLYmcD8YZAkb8DoEA/IdiH+0RmIDNPM87TVYme8rJ/8UGssPL4IX/1s+m\n7J6dL0izLNuVaANEDsgF\n-----END CRYPTUTIL VERIFIED KEY-----\n
\n\nAnd emailed you (_out-of-band_) the key's fingerprint for you to confirm/match :D\n\nsalt -u -import - to import
@xuu I _guess _ I need your public key salt -export - ๐Ÿ˜€

Here's mine:


-----BEGIN CRYPTUTIL VERIFIED KEY-----
MIHMBEBS3sgNEUEhGu8K7pgxT0b4cRpxdlRhteO8ZEsMawvJe7snRFMNThuOKnZo
MEc+VvTOeLYGiw1ZFG6XbY9WyvQcBEBS3sgNEUEhGu8K7pgxT0b4cRpxdlRhteO8
ZEsMawvJe7snRFMNThuOKnZoMEc+VvTOeLYGiw1ZFG6XbY9WyvQcAgRf1h2qBECA
lBBT/KRNLYmcD8YZAkb8DoEA/IdiH+0RmIDNPM87TVYme8rJ/8UGssPL4IX/1s+m
7J6dL0izLNuVaANEDsgF
-----END CRYPTUTIL VERIFIED KEY-----


And emailed you (_out-of-band_) the key's fingerprint for you to confirm/match :D

salt -u -import - to import