What Changed on Nexus
A notebook of quiet shifts on Nexus Market
Three Nexus addresses, published as supplied. No labels, no ranking, no claim any of them opens right now.

First-time PGP handling on Nexus has changed shape

in the past few months ยท readers

New readers are still learning PGP on the first Nexus order, but the tools they reach for have changed, and the mistakes they make with them are a different set from a year ago.

How it read before

A first-time reader used to install a desktop PGP tool, generate a key pair, paste the vendor key into the same tool, and encrypt the address block by clicking through a menu. The whole process was clunky. The mistakes were also clunky, and mostly at the setup stage: passphrase forgotten, private key not backed up, the wrong subkey used to sign, the vendor key imported but never trusted. The mistakes tended to fail loudly.

The mental model was simple. There was one tool. Everything the reader did with PGP happened inside that tool. If they did the wrong thing, the tool told them.

How it reads now

The tool of choice has shifted toward browser-based encryption pages and, in some cases, mobile apps. That change has flipped which mistakes are common. The old mistakes are less frequent. The new ones tend to be:

  • The reader encrypts against a vendor key they lifted from a page other than the market, and the key is out of date. See PGP keys are now quoted inside the Nexus listing header for where the current key sits.
  • The reader pastes their address into a browser-based encrypt tool that logs input. The address block is then encrypted and also sitting in a third-party server log.
  • The reader encrypts, pastes the ciphertext, and does not check that the ciphertext contains the expected header line. A truncated paste is delivered as intact ciphertext.
  • The reader has never had a private key of their own, so when the vendor replies with an encrypted message the reader cannot read it, and asks the vendor to resend in plaintext.

The mistakes are quieter than they used to be. They do not fail at the reader's screen. They fail later, at the vendor's screen, or at the door.

The one habit that still holds the order together, across every tooling shift, is the reader owning a real private key. Not just a passphrase they typed into a web page. A private key file, stored on their own device, backed up somewhere they can find it. Without that, the vendor's encrypted reply becomes an unreadable block of characters, and the reader has to break the encryption model of the order to see what the vendor said. The fastest way to do that is to ask the vendor to resend in plaintext, which defeats the point of the whole exchange.

Why this probably shifted

A few things are aligned. The browser-based tools are easier to start with. Mobile apps put PGP in a familiar shape. Vendors have moved their keys around; see PGP signed invoices for one place they now appear. The reader is meeting PGP in more places than one, and each place has slightly different mechanics. Instead of learning one tool well, the reader learns three tools shallowly.

What to change on your side

Pick one tool, install it locally, and use it for every step. The habit that still saves the order is a small one.

  • Encrypt on your own device, not on a browser page whose host you did not vet.
  • Take the vendor key from the current listing header on the market, not from a screenshot passed around a chat.
  • Before you paste the ciphertext into the order, read the first and last lines of it. If it does not begin with a proper BEGIN block and end with the matching END, the paste is broken. Start over.
  • Generate a private key of your own on the first order, even if it feels like overkill. When the vendor replies encrypted, you will need it.

What this entry is not claiming

The entry is not claiming that any particular tool is unsafe. Local tools have bugs; browser tools have merits; the point is only that the reader who moves through several tools during one order has more surface for a quiet mistake than the reader who does the whole flow inside one. It is also not a claim that the market has done anything to change the PGP requirement; that side has stayed the same.