tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like somekey.sig.asc are smaller files.

I'm trying to learn the whole gpg thing and practice using it correctly. A crucial step is verifying that a public key does in fact belong to the party it is supposed to. In the absence of a chain of personal contacts, the obvious thing is to get multiple copies from different sources and verify that they are identical. I never can seem to do that. I suspect that part of the problem lies in newlines, carriagereturns, spaces, tabs, and other characters invented by the SCOPTDUI (Secret Conspiracy Of Programmers To Drive Users Insane). Here is an example where I'm fairly sure the keys ARE identical, but I can't come up with a procedure to prove it.

Veracrypt team key from the MIT keyserver: https://pgp.mit.edu/pks/lookup?op=get&search=0xEB559C7C54DDD393

Veracrypt team key from the Veracrypt site: https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc

I've downloaded both directly. I've copied and pasted both into text files. I've stripped away the preambles and the endings, leaving blocks that each begin with the same gibberish and end with the same gibberish.

I've run them through all sorts of tr filters, like: cat file | tr -d '\040\011\012\015' > file-tred The one from MIT is still a lot bigger file. I've loaded them into gedit and I can copy substantial chunks of one and search for that chunk in the other and find an identical substring, but not with the whole file.

This isn't an isolated example. MIT isn't unique. The second keyserver I checked (in New Zealand, but I'm not allowed to post a third link here) has the same issue. Nor is Veracrypt a special case. I've run into this every time I've resolved to learn to do gpg the "right way" and beat my head against the same wall for a few days before giving up. Is there some reason these things aren't published in a standardised form? Is there some way to make this easy? Am I missing something obvious? What makes that MIT file so big?

Addendum: As a practical matter:

gpg --keyserver address.like-this-with-no-protocol-prefix-and-no-trailing-slash.net --search SOMETHING

seems to be checking duplicates of keys that I already have and reporting "no change", provided I choose SOMETHING well. So, functionally, I guess this is ok. I'd still like to know why my manual comparisons fail.

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like somekey.sig.asc are smaller files.

I'm trying to learn the whole gpg thing and practice using it correctly. A crucial step is verifying that a public key does in fact belong to the party it is supposed to. In the absence of a chain of personal contacts, the obvious thing is to get multiple copies from different sources and verify that they are identical. I never can seem to do that. I suspect that part of the problem lies in newlines, carriagereturns, spaces, tabs, and other characters invented by the SCOPTDUI (Secret Conspiracy Of Programmers To Drive Users Insane). Here is an example where I'm fairly sure the keys ARE identical, but I can't come up with a procedure to prove it.

Veracrypt team key from the MIT keyserver: https://pgp.mit.edu/pks/lookup?op=get&search=0xEB559C7C54DDD393

Veracrypt team key from the Veracrypt site: https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc

I've downloaded both directly. I've copied and pasted both into text files. I've stripped away the preambles and the endings, leaving blocks that each begin with the same gibberish and end with the same gibberish.

I've run them through all sorts of tr filters, like:

cat file | tr -d '\040\011\012\015' > file-tred

The one from MIT is still a lot bigger file. I've loaded them into gedit and I can copy substantial chunks of one and search for that chunk in the other and find an identical substring, but not with the whole file.

This isn't an isolated example. MIT isn't unique. The second keyserver I checked (in New Zealand, but I'm not allowed to post a third link here) has the same issue. Nor is Veracrypt a special case. I've run into this every time I've resolved to learn to do gpg the "right way" and beat my head against the same wall for a few days before giving up. Is there some reason these things aren't published in a standardised form? Is there some way to make this easy? Am I missing something obvious? What makes that MIT file so big?

Addendum: As a practical matter:

gpg --keyserver address.like-this-with-no-protocol-prefix-and-no-trailing-slash.net --search SOMETHING

seems to be checking duplicates of keys that I already have and reporting "no change", provided I choose SOMETHING well. So, functionally, I guess this is ok. I'd still like to know why my manual comparisons fail.

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like somekey.sig.asc are smaller files.

I'm trying to learn the whole gpg thing and practice using it correctly. A crucial step is verifying that a public key does in fact belong to the party it is supposed to. In the absence of a chain of personal contacts, the obvious thing is to get multiple copies from different sources and verify that they are identical. I never can seem to do that. I suspect that part of the problem lies in newlines, carriagereturns, spaces, tabs, and other characters invented by the SCOPTDUI (Secret Conspiracy Of Programmers To Drive Users Insane). Here is an example where I'm fairly sure the keys ARE identical, but I can't come up with a procedure to prove it.

Veracrypt team key from the MIT keyserver: https://pgp.mit.edu/pks/lookup?op=get&search=0xEB559C7C54DDD393

Veracrypt team key from the Veracrypt site: https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc

I've downloaded both directly. I've copied and pasted both into text files. I've stripped away the preambles and the endings, leaving blocks that each begin with the same gibberish and end with the same gibberish.

I've run them through all sorts of tr filters, like: cat file | tr -d '\040\011\012\015' > file-tred The one from MIT is still a lot bigger file. I've loaded them into gedit and I can copy substantial chunks of one and search for that chunk in the other and find an identical substring, but not with the whole file.

This isn't an isolated example. MIT isn't unique. The second keyserver I checked (in New Zealand, but I'm not allowed to post a third link here) has the same issue. Nor is Veracrypt a special case. I've run into this every time I've resolved to learn to do gpg the "right way" and beat my head against the same wall for a few days before giving up. Is there some reason these things aren't published in a standardised form? Is there some way to make this easy? Am I missing something obvious? What makes that MIT file so big?

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like somekey.sig.asc are smaller files.

I'm trying to learn the whole gpg thing and practice using it correctly. A crucial step is verifying that a public key does in fact belong to the party it is supposed to. In the absence of a chain of personal contacts, the obvious thing is to get multiple copies from different sources and verify that they are identical. I never can seem to do that. I suspect that part of the problem lies in newlines, carriagereturns, spaces, tabs, and other characters invented by the SCOPTDUI (Secret Conspiracy Of Programmers To Drive Users Insane). Here is an example where I'm fairly sure the keys ARE identical, but I can't come up with a procedure to prove it.

Veracrypt team key from the MIT keyserver: https://pgp.mit.edu/pks/lookup?op=get&search=0xEB559C7C54DDD393

Veracrypt team key from the Veracrypt site: https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc

I've downloaded both directly. I've copied and pasted both into text files. I've stripped away the preambles and the endings, leaving blocks that each begin with the same gibberish and end with the same gibberish.

I've run them through all sorts of tr filters, like: cat file | tr -d '\040\011\012\015' > file-tred The one from MIT is still a lot bigger file. I've loaded them into gedit and I can copy substantial chunks of one and search for that chunk in the other and find an identical substring, but not with the whole file.

This isn't an isolated example. MIT isn't unique. The second keyserver I checked (in New Zealand, but I'm not allowed to post a third link here) has the same issue. Nor is Veracrypt a special case. I've run into this every time I've resolved to learn to do gpg the "right way" and beat my head against the same wall for a few days before giving up. Is there some reason these things aren't published in a standardised form? Is there some way to make this easy? Am I missing something obvious? What makes that MIT file so big?

Addendum: As a practical matter:

gpg --keyserver address.like-this-with-no-protocol-prefix-and-no-trailing-slash.net --search SOMETHING

seems to be checking duplicates of keys that I already have and reporting "no change", provided I choose SOMETHING well. So, functionally, I guess this is ok. I'd still like to know why my manual comparisons fail.

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like somekey.sig.asc are smaller files.

I'm trying to learn the whole gpg thing and practice using it correctly. A crucial step is verifying that a public key does in fact belong to the party it is supposed to. In the absence of a chain of personal contacts, the obvious thing is to get multiple copies from different sources and verify that they are identical. I never can seem to do that. I suspect that part of the problem lies in newlines, carriagereturns, spaces, tabs, and other characters invented by the SCOPTDUI (Secret Conspiracy Of Programmers To Drive Users Insane). Here is an example where I'm fairly sure the keys ARE identical, but I can't come up with a procedure to prove it.

Veracrypt team key from the MIT keyserver: https://pgp.mit.edu/pks/lookup?op=get&search=0xEB559C7C54DDD393

Veracrypt team key from the Veracrypt site: https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc

I've downloaded both directly. I've copied and pasted both into text files. I've stripped away the preambles and the endings, leaving blocks that each begin with the same gibberish and end with the same gibberish.

I've run them through all sorts of tr filters, like: cat file | tr -d '\040\011\012\015' > file-tred The one from MIT is still a lot bigger file. I've loaded them into gedit and I can copy substantial chunks of one and search for that chunk in the other and find an identical substring, but not with the whole file.

This isn't an isolated example. MIT isn't unique. The second keyserver I checked (in New Zealand, but I'm not allowed to post a third link here) has the same issue. Nor is Veracrypt a special case. I've run into this every time I've resolved to learn to do gpg the "right way" and beat my head against the same wall for a few days before giving up. Is there some reason these things aren't published in a standardised form? Is there some way to make this easy? Am I missing something obvious? What makes that MIT file so big?

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like somekey.sig.asc are smaller files.

I'm trying to learn the whole gpg thing and practice using it correctly. A crucial step is verifying that a public key does in fact belong to the party it is supposed to. In the absence of a chain of personal contacts, the obvious thing is to get multiple copies from different sources and verify that they are identical. I never can seem to do that. I suspect that part of the problem lies in newlines, carriagereturns, spaces, tabs, and other characters invented by the SCOPTDUI (Secret Conspiracy Of Programmers To Drive Users Insane). Here is an example where I'm fairly sure the keys ARE identical, but I can't come up with a procedure to prove it.

Veracrypt team key from the MIT keyserver: https://pgp.mit.edu/pks/lookup?op=get&search=0xEB559C7C54DDD393

Veracrypt team key from the Veracrypt site: https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc

I've downloaded both directly. I've copied and pasted both into text files. I've stripped away the preambles and the endings, leaving blocks that each begin with the same gibberish and end with the same gibberish.

I've run them through all sorts of tr filters, like: cat file | tr -d '\040\011\012\015' > file-tred The one from MIT is still a lot bigger file. I've loaded them into gedit and I can copy substantial chunks of one and search for that chunk in the other and find an identical substring, but not with the whole file.

This isn't an isolated example. MIT isn't unique. The second keyserver I checked (in New Zealand, but I'm not allowed to post a third link here) has the same issue. Nor is Veracrypt a special case. I've run into this every time I've resolved to learn to do gpg the "right way" and beat my head against the same wall for a few days before giving up. Is there some reason these things aren't published in a standardised form? Is there some way to make this easy? Am I missing something obvious? What makes that MIT file so big?