Don't trust, verify¶
Reproducible & signed
The CoinJoin coordination runs as a hosted service. The one part that ever touches your private keys — the signer — is source-available, so you can confirm your keys never leave your machine.
Sign locally, then submit¶
# sign each of your inputs offline (key stays on your machine)
java -jar offlinesigner.jar \
--index 0 --isMainnet false \
--sourceAddress tb1q… --rawTransaction <candidate> \
--prevScriptPubKey <hex> --prevValue <sats>
# only the final, signed transaction is uploaded over the API
Verifying a release¶
Every signer release is built reproducibly, so the binary you run is provably the code you read.
# 1. hash the download
sha256sum offlinesigner.jar
# 2. compare it to the published checksum file
cat SHA256SUMS
# 3. import the key and confirm the fingerprint below, then verify the detached signature
gpg --import umbraset-release-signing-pub.asc
gpg --fingerprint valerianwallet@proton.me
gpg --verify SHA256SUMS.asc SHA256SUMS
Release signing key fingerprint:
Where the public key lives
The release-signing public key (download it here) is pinned in multiple independent places — this site, the source repository, and (soon) the project's Nostr profile — so a single compromised host can't swap it. Always check the fingerprint itself, not just that some signature verifies. TLS protects the download; the signature is what protects the artifact.
Warning
A signed jar is not auto-verified by the JVM, and a TLS certificate is the wrong key type for signing code. Trust comes from reproducible build + checksum + detached signature, not from the transport.
Ready to try it?