A clear signed message: the layout

A message left readable, with a signature block fastened to the bottom of it.

The shape

Three landmarks, in order down the page: an opening marker, then text a person can read, then a signature block that closes the whole thing. The readable part is the only place in this family where ordinary words appear inside the fence.

Opening marker: five hyphens, BEGIN PGP SIGNED MESSAGE, five hyphens
Field line: normally Hash: followed by the name of a digest algorithm
First separator: one empty line, then the readable text begins
Readable part: ordinary text, in the clear, of any length
Escape rule: a line of the message that starts with a hyphen is prefixed with a hyphen and a space
Second landmark: the line -----BEGIN PGP SIGNATURE----- ends the readable part
Final line: -----END PGP SIGNATURE-----
Absent line: there is no closing marker for the signed message itself; the signature footer ends the document

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

The readable part sits here, in the clear, and can run
for as many lines as it likes.
- - a message line that began with a hyphen, escaped
-----BEGIN PGP SIGNATURE-----

[body: 12 lines of base64 characters, removed here]
=xxxx
-----END PGP SIGNATURE-----

Note the last line. A document of this kind finishes on the signature footer, and a line reading END PGP SIGNED MESSAGE does not exist in the format.

The Hash: line names which digest was used. It is normally present and it names an algorithm, not a value; it is not a checksum and nothing about it is meant to be compared against anything. Some older output leaves it out.

Dash escaping

The readable part sits inside a fence made of hyphen runs, which raises an obvious ambiguity: what happens when the message itself contains a line that starts with a hyphen. The format resolves it by escaping. Any message line beginning with a hyphen is written out with a hyphen and a space in front of it, so that no line of the message can be mistaken for a marker.

Reading in the other direction, when you see a raw document, a line that begins with a hyphen and a space is showing you an escape. The message said one thing and the file shows two extra characters. Software that displays the message removes them again.

As stored

- - a bullet the writer typed as a hyphen
- -----BEGIN PGP SIGNATURE-----

As the writer typed it

- a bullet the writer typed as a hyphen
-----BEGIN PGP SIGNATURE-----

Two characters, a hyphen and a space, added to the front of any line that started with a hyphen. Nothing else about the line changes.

This rule is mangled often, because people edit signed messages by hand. Add a bulleted list to a message after the fact, forget the escape, and the document now contains lines that look like fence posts. Strip the escapes to make the text tidy for reading, and the document no longer matches what was signed. Both edits leave something that still looks orderly on screen.

How to check it by eye

Three landmarks, top to bottom

Read the opening marker and confirm the word SIGNED is there. Without it you are looking at a different member of the family.
Find the empty line under the Hash: field. The readable text starts on the line after it.
Find the boundary: the line where readable words stop and BEGIN PGP SIGNATURE begins. That single line is the hinge of the whole layout.
Read the very last line. It should close the signature, not the message.
Run your eye down the left margin of the readable part looking for lines that open with a hyphen, and check they carry the escape.

What a wrong shape means

The commonest fault is a document that has been pulled apart. A forum post keeps the message and drops the signature block because it looked like noise. A reply quotes the readable part only. A screenshot preserves the words and none of the structure. In each case the missing piece is missing because a human decided it was not interesting.

Structural faults are narrower. Two empty lines instead of one under the field. Escapes stripped by a helpful editor. A signature block that begins but never closes, cut off by a length limit. None of these tell you who did it; they tell you the document went through a system that reformats text.

There is one more case worth separating out. A document can be perfectly formed and still have been assembled by hand, because building this layout takes a text editor and nothing else.

What a correct shape does not prove

Here the gap between shape and substance is at its widest, because the readable part invites you to treat the words as the point. The words are the part nobody had to earn.

That the visible text is the text that was signed. A signature covers exact bytes, including spaces at the ends of lines, which you cannot see.
That the signature block belongs to this message. A signature lifted from one document and pasted under another produces a page that satisfies every rule on this card.
That anybody in particular wrote it. The layout carries no name that a reader can rely on.
When it was written. A date inside the readable part is text typed by the author, and dates in text are covered at a timestamp printed on a page.
That it was ever checked. Reading the layout is not checking the signature, and this site checks nothing, including any claim about an awazon market link.

The layout is a container for a claim. Nothing about the container decides whether the claim is true.

What this card is not

The signature standing alone, without a message wrapped around it, is a different shape and has its own entry at a detached signature block. Damage caused by quoting is catalogued at a quoted message block, and the trailing checksum is at the checksum line.

A clear signed message