I have started signing my mail with PGP, and it attaches the file signature.asc to my messages to verify that I sent them with content, as you'd expect, like this:



Is it possible to include a "comment" with the signature file? If someone uses PGP/GPG they will just see a message that the email was signed. But most people I send mail to do not use PGP, so they will see this attachment and perhaps will be confused - is it possible to include a "comment" in this file (ideally auto-generated) which explains that what the signature means to the uninitiated?

3 Answers 3


OpenPGP, RFC 4880 "Forming ASCII Armor", defines a way to add comments to ASCII-armored OpenPGP data.

Using GnuPG (no matter whether using GPGTools or not), this comment can be configured using the comment option, either as gpg --comment or in the GnuPG config file ~/.gnupg/gpg.conf, for example

comment Comment you want to add in each file.

The Apple Mail plugin does not overwrite the option, thus the comment will also be added to mails sent using Apple Mail.

  • ok gpg.conf is a trick I haven't thought of. +1.
    – user10008
    Commented Sep 20, 2014 at 10:42

Yes it is possible. See this as an example. RFC 2440 allows arbitrary comment lines starting with "Comment:":

Currently defined Armor Header Keys are:

  • "Version", that states the OpenPGP Version used to encode the message.

  • "Comment", a user-defined comment.

  • [...]

The spec is silent about whether multiple comments may be specified but with my tests with gpg --verify it accepted multiple comments.

Changing or adding comments (for example with a text editor) doesn't make the signature invalid, as they are not part of the signed message.

Theroretically it is possible to use them, but for GPGTools I can't think of a way to add them on an automated basis. Note that I came to this conclusion through review of the source code, and a screenshot on this site.

You can however add a "signature" to your email telling about the asc file and its contents.

  • Thanks! Can you elaborate more on how to do this practically?
    – Jason
    Commented Sep 20, 2014 at 7:25
  • Which tool do you use?
    – user10008
    Commented Sep 20, 2014 at 7:27
  • GPGTools for mac
    – Jason
    Commented Sep 20, 2014 at 7:28

I put a comment at the end of the message text (part of a sig, really), where people are much more likely to see it: About PGP signatures (http://xkcd.com/1181)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .