I understand the interest of using a PGP solution that is based on a OpenPGP smartcard, such as the Nitrokey Pro or similar. But then, how can I decide that I trust an OpenPGP smartcard?

  • 1
    There is no binary decision between to trust or not to trust. Like in real-life there is only more trust or less trust. It is about the actual risks which are relevant in your specific environment and not about some theoretical risks. Commented Feb 24, 2020 at 9:46

2 Answers 2


The same way you trust GPG running on your Intel or AMD CPU.

You either trust the vendor or audit the code and hardware yourself.

In practice, probably a bit of both. e.g. you trust the vendor of the micro-controller but audit the software running on it.


The Nitorkey Pro software and hardware are open source, so technically and if you have doubts, you can audit the code yourself.

You can also easily check that your device works according to the specs.

However, as mentioned in a previous answer, the risk can be assessed to your own threat model more than anything else. If you are tracked by 3 letters agency, it will be hard to secure the keys.

  • Just because the software is open source doesn't mean that's what's running on the card.
    – user163495
    Commented Nov 26, 2020 at 21:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .