Contact

Where to write, and how to write privately.

support@qurak.com

Technical support, product questions, and security reports.

Fingerprint: 786E F53D 8D76 1C23 D622 5ADC E4F3 4AC6 D3BA 9E37
Public key: /.well-known/pgp/support.asc
SHA-256 of that file: 0015a620d487b725c8f23c8ae4bc847fc4eb2bb8b4e3fab5f739bdf3704028f8
Independently published at: keys.openpgp.org

hello@qurak.com

Sales, billing, and commercial questions.

Fingerprint: D73A 31D3 AA90 AD78 F834 BC0E C3B4 512C 2210 909D
Public key: /.well-known/pgp/hello.asc
SHA-256 of that file: 370c52fd87167b381b14c68a82debc16779fa6430dda5abbdd769addc0d25bce
Independently published at: keys.openpgp.org

Verifying a key

A fingerprint is a hash of the key itself, so it is the check that matters: fetch the key, print its fingerprint, and compare it against this page and against the copy on keys.openpgp.org. This domain also publishes a Web Key Directory, so gpg can find the key from the address alone.

shell

gpg --locate-keys support@qurak.com

curl -sO https://qurak.com/.well-known/pgp/support.asc
sha256sum support.asc          # compare with the digest above
gpg --show-keys support.asc    # compare with the fingerprint above

The digest is published for the narrow thing it does: it catches a corrupted download, and it lets you check the bytes before importing them into your keyring. It is not a defence against someone who can change what this server sends, because they could change the digest too. The fingerprint, cross-checked against a source that is not us, is the check that is worth making.

Security reports reach the first address above, and are read by the people who can fix what you found. The machine-readable version of this page is at /.well-known/security.txt.