PGP canaries in plain language
Why signed text beats logo recognition.
A canary is a signed status message. You import a known public key and verify the signature locally.
Failure modes
- Importing a key from the phishing page itself
- Trusting “Verified” badges in a browser UI
- Skipping verification because the theme looks right