What does "Good signature" mean exactly?

It means the signature was produced by the holder of the private key matching the public key you supplied, and the signed bytes have not been altered since signing. It does not say anything about whether the public key actually belongs to the person you think — that is a trust question, not a cryptographic one.

Why would verification fail?

Common causes: wrong public key, tampered content (even one extra newline can break it), corrupted signature block, or an expired/revoked signing key. The error message names the specific reason.

How do I know the public key really belongs to the signer?

Out-of-band verification: meet in person, video call, fingerprint comparison, web-of-trust signatures, or fetching from a verified keyserver. PGP itself only proves the cryptographic link between the key and the signature.

Does PGP Tool fetch public keys automatically?

Only via the Key Inspector tool, and only when air-gap mode is off. Verify itself never makes network requests.

Are timestamps inside signatures trustworthy?

They are signed, so they cannot be altered after the fact, but they reflect what the signer claimed at sign time — they are not externally certified. For independent timestamping, use the Notary tool.

تحقق

تحقق من صحة الرسائل والملفات الموقعة بـ PGP.

كل شيء يعمل في متصفحك — بلا خادم وبلا تتبّع.