Security & authenticity

Verify that this content really comes from Teddy JEAN-BAPTISTE

Articles published on this blog may be digitally signed with an OpenPGP (GPG) key. This signature does not prevent copying, but allows any reader to independently verify that an article was indeed published and signed by Teddy JEAN-BAPTISTE, and that its content has not been altered since it was signed.

What the signature attests

  • ✓Provenance: the content genuinely comes from the private key holder (Teddy JEAN-BAPTISTE, via a physical YubiKey).
  • ✓Integrity: the content hasn't been altered since the moment it was signed.
  • ✓Human review and endorsement: several articles are co-written with AI agents (ChatGPT, Claude). The signature certifies that Teddy JEAN-BAPTISTE reviewed and validated the final content before publishing — AI may have contributed to drafting, but editorial responsibility remains human.

🔑GPG public key

Fingerprint

1B9B FDBE 03A5 173D 3939 3924 3F52 DB76 391A 52ED

Key server

The up-to-date public key is available on keys.openpgp.org, a server that verifies ownership of every email address linked to a key before exposing it publicly.

https://keys.openpgp.org/vks/v1/by-fingerprint/1B9BFDBE03A5173D393939243F52DB76391A52ED

Verified identities (UID)

  • • Teddy JEAN-BAPTISTE<>
  • • Teddy JEAN-BAPTISTE<>

✅Verify a signed article

Every signed article ships with two proof files, available from the article page: a detached signature (.asc) and a sha256 checksum (.sha256) of the source content.

  1. 1. Fetch the public key from keys.openpgp.org
    gpg --keyserver hkps://keys.openpgp.org --recv-keys 1B9BFDBE03A5173D393939243F52DB76391A52ED
  2. 2. Download the article's source file along with its signature (.asc)
  3. 3. Verify the signature with GPG
    gpg --verify fr.mdx.asc fr.mdx

A valid signature confirms two things: the content genuinely comes from the private key holder, and it hasn't been altered since it was signed.

🔄Key rotation

The signing key has a limited lifetime and must be renewed before it expires. The procedure is documented in the videos below: renewing an expired GPG key and syncing with GitHub. Previous public keys are kept so that already-signed articles remain verifiable.

Renewing an expired GPG key for GitHub — Git signing

Renewing an expired GPG key and syncing with GitHub via glab

⚠️What this proof does not cover

A GPG signature proves the authenticity and integrity of the signed content at the time it was signed. It does not prevent the text from being copied, does not guarantee the content will remain available in the future, and does not cover editorial changes published after the signature (in which case a new signature is required).