
Installing GnuPG 55
If you look at the download site closely, you’ll see three
offerings for any given version of GnuPG.
GnuPG 1.4.0a compiled for Microsoft Windows.
Signature and SHA-1 checksum for previous file.
28be01b7f8eaa29db73d11bf8b9504e823c07c2b
gnupg-w32cli-1.4.0a.zip
The first entry is the GnuPG program itself. The second
entry is a file containing a digital signature of the first down-
load. A download is a message like any other, and checking its
digital signature is the preferred way to confirm its integrity.
This gives us a chicken-and-egg problem, however: How can
you verify the signature on the software that verifies signa-
tures? ...