Security Dec 5, 2025

PGP verification now mandatory

New vendors must submit and verify PGP keys before any listings go active. Existing vendors have 72 hours to comply or face automatic suspension.

Rollout timeline

T+0h · Policy live

New vendor accounts cannot publish any listings until at least one PGP key is submitted and cryptographically verified inside Nexus marketplace.

T+24h · Warning phase

Existing vendors receive in-account warnings and cannot edit payout settings until a valid PGP key is attached. All messages remind them about the 72‑hour deadline.

T+72h · Enforcement

Non‑compliant vendor accounts are switched to suspended state. Listings are hidden from search and new orders cannot be placed until verification succeeds.

Verification flow

Upload your public PGP key to the Nexus vendor profile or paste it as armored text.
Download a unique challenge block generated by the marketplace and sign it with your PGP key.
Post the signature back into the verification form. Nexus validates it server‑side.
Once the signature is confirmed, the key is marked as trusted and listings can go live.

What happens if you ignore it?

Immediate

New vendors: no listings, no escrow payouts

+72h

Old vendors: account suspended, listings hidden

Disputes

Unverified vendors lose priority in dispute resolution

Trust

Buyers can filter out non‑PGP‑verified vendors entirely

PGP readiness checklist

Key length at least 4096‑bit.
Key not reused across clearnet identity.
Backup of private key stored offline.
Fingerprint written down and verified inside Nexus.

Why force PGP now?

Nexus marketplace is moving all sensitive communication — disputes, shipping data, high‑risk orders — to PGP‑only mode to reduce metadata leaks and phishing via fake vendor accounts.

Does this affect buyers?

Buyers can continue without keys, but any serious trade should use PGP. Vendors may require encrypted messages for delivery details and will prefer PGP‑capable buyers.