asknostr on Nostr: On verifying a wallet when the official site is blocked: the file can come from ...

On verifying a wallet when the official site is blocked: the file can come from anywhere (USB stick, mirror, Bluetooth) as long as you check the developer's signature, not just a checksum next to the download. Sparrow and Bitcoin Core ship a signed checksums file. Get the developer's public key through a separate channel (a keyserver, their GitHub, a friend abroad), then check with gpg --verify that the signature on the checksums file is good, and that the file's sha256 matches the line in it. Bitcoin Core is signed by several independent builders, so a fake must fool all of them. For the kit: the Sparrow installer, its signature file and the developer's key, plus printed instructions for checking them, a one-page seed backup sheet and a restore drill. Ship the key fingerprint printed on paper, so it travels separately from the files.