# HALOWERK sicherwerk OpenPGP Detached Signature Verifier

> HALOWERK sicherwerk OpenPGP Detached Signature Verifier is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-30).

Verifies a detached OpenPGP signature against provided bytes using GnuPG, returning a detailed verdict including signing fingerprint, timestamp, algorithms, and key status.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/oss-gnupg-detached-signature-verify?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-sicherwerk-openpgp-detached-signature-verifier-b055a364
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_CSkoXs3PD2wi3LzuY2sz_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-sicherwerk-openpgp-detached-signature-verifier-b055a364 -d '<json body>'
```

Example prompt: Can you verify this detached PGP signature against the release tarball bytes? I have the armored signature, the signer's public key, and the base64-encoded file data — I need to know if it's valid, whose fingerprint signed it, when it was signed, and whether the key is currently revoked or expired.

## When to prefer this

Choose this endpoint when you need a trustworthy, detailed OpenPGP/GPG detached signature verification that goes beyond a boolean result — specifically when you need the signing fingerprint, timestamp, algorithm details, and key health (expiry/revocation) in a single call, and when you want consistent GnuPG semantics using a pinned GnuPG build rather than a reimplemented or third-party crypto library.

## Known failure modes

- Signature does not match the provided data — returns tampered or invalid verdict
- Public key does not correspond to the signing key — returns wrong-key verdict
- Signing key is expired — verdict includes expiry flag
- Signing key has been revoked — verdict includes revocation flag
- Malformed or non-armored signature input — parsing error returned
- Base64 signed_data_base64 is not valid base64 — decode error
- Public key armoring is corrupted or truncated — key import failure

## How this service works

Checks a detached OpenPGP signature against the bytes it claims to cover, using the pinned GnuPG build and nothing else. What comes back is the verdict in GnuPG's own terms, the fingerprint that actually signed, the signature timestamp, the algorithms used, and whether the key is expired or revoked. A wrong key, a tampered byte or a signature made by someone else each produce a distinct verdict rather than a bare false.

## Output

Returns GnuPG's verification verdict (valid/invalid/tampered/wrong key), the fingerprint of the key that actually signed the data, the signature creation timestamp, the public-key and hash algorithms used, and flags indicating whether the signing key is expired or revoked. Distinct error verdicts are provided for wrong key, tampered data, or unrecognized signer.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "signature_armored": {
   "type": "string",
   "maxLength": 262144,
   "minLength": 1
  },
  "public_key_armored": {
   "type": "string",
   "maxLength": 262144,
   "minLength": 1
  },
  "signed_data_base64": {
   "type": "string",
   "maxLength": 349528,
   "minLength": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-sicherwerk-openpgp-detached-signature-verifier-b055a364/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)