<blockquote>
<p>Question: Can I still trust the Suite?</p>
</blockquote>
<p>Yes. GPG indicates that there is a valid signature for SatoshiLab's signing key.</p>
<p>GPG has a thing called the &quot;trust database&quot; (trustdb). This is a local database of keys that you have told GPG that you trust, with trust meaning that you have verified that the owner of that key is who the key says it belongs to. By default, keys are not trusted or have an unknown trust value as you have to verify the identity externally, and then inform GPG.</p>
<p>So the warning that you see is simply GPG telling you that this particular key does not have a trusted value in the trustdb. You have not told GPG that you trust this key, and it is merely reminding you of this fact.</p>

CC BY-SA 4.0
2021-12-20T23:24:10.040Z
Thank you for the answer.
I'd recommend Satoshi Labs to include this information in their instructions so newbies don't panic :)
Sil
CC BY-SA 4.0
2021-12-17T17:53:01.683Z
2021-12-17T17:53:01.683Z
Ava Chow
<p>These are the steps I took:</p>
<ol>
<li><p>open <a href="https://suite.trezor.io/" rel="nofollow noreferrer">https://suite.trezor.io/</a></p>
</li>
<li><p>download the 3 files: Desktop app, signature and signing key</p>
</li>
<li><p>follow the instructions <a href="https://wiki.trezor.io/Apps:Trezor_Suite#How_to_run" rel="nofollow noreferrer">https://wiki.trezor.io/Apps:Trezor_Suite#How_to_run</a>, How to verify the binaries,2 terminal commands.</p>
</li>
<li></li>
</ol>
<pre><code>/Downloads$ gpg --import satoshilabs-2021-signing-key.asc
gpg: key E21B6950A2ECB65C: 1 signature not checked due to a missing key
gpg: key E21B6950A2ECB65C: &quot;SatoshiLabs 2021 Signing Key&quot; not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
</code></pre>
<ol start="5">
<li></li>
</ol>
<pre><code>~/Downloads$ gpg --verify Trezor-Suite-21.12.2-linux-x86_64.AppImage.asc
gpg: assuming signed data in 'Trezor-Suite-21.12.2-linux-x86_64.AppImage'
gpg: Signature made Wed 08 Dec 2021 10:45:00 AM MST
gpg:                using RSA key EB483B26B078A4AA1B6F425EE21B6950A2ECB65C
gpg: Good signature from &quot;SatoshiLabs 2021 Signing Key&quot; [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EB48 3B26 B078 A4AA 1B6F  425E E21B 6950 A2EC B65C
</code></pre>
<p>Question: <strong>Can I still trust the Suite?</strong></p>
<p>Thanks</p>

<linux><trezor>
SatoshiLabs 2021 Signing Key" [unknown] gpg: WARNING: This key is not certified with a trusted signature!
Sil
# SatoshiLabs 2021 Signing Key" [unknown] gpg: WARNING: This key is not certified with a trusted signature!

(Asked by: username_0 on 2021-12-16)

These are the steps I took:

1. open <https://suite.trezor.io/>
2. download the 3 files: Desktop app, signature and signing key
3. follow the instructions <https://wiki.trezor.io/Apps:Trezor_Suite#How_to_run>, How to verify the binaries,2 terminal commands.

```
/Downloads$ gpg --import satoshilabs-2021-signing-key.asc
gpg: key E21B6950A2ECB65C: 1 signature not checked due to a missing key
gpg: key E21B6950A2ECB65C: "SatoshiLabs 2021 Signing Key" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

```

```
~/Downloads$ gpg --verify Trezor-Suite-21.12.2-linux-x86_64.AppImage.asc
gpg: assuming signed data in 'Trezor-Suite-21.12.2-linux-x86_64.AppImage'
gpg: Signature made Wed 08 Dec 2021 10:45:00 AM MST
gpg:                using RSA key EB483B26B078A4AA1B6F425EE21B6950A2ECB65C
gpg: Good signature from "SatoshiLabs 2021 Signing Key" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EB48 3B26 B078 A4AA 1B6F  425E E21B 6950 A2EC B65C

```

Question: **Can I still trust the Suite?**

Thanks

**Tags:** linux, trezor


---

## 1 answers

### Answer by username_1 on 2021-12-17. Score: 1

> Question: Can I still trust the Suite?

Yes. GPG indicates that there is a valid signature for SatoshiLab's signing key.

GPG has a thing called the "trust database" (trustdb). This is a local database of keys that you have told GPG that you trust, with trust meaning that you have verified that the owner of that key is who the key says it belongs to. By default, keys are not trusted or have an unknown trust value as you have to verify the identity externally, and then inform GPG.

So the warning that you see is simply GPG telling you that this particular key does not have a trusted value in the trustdb. You have not told GPG that you trust this key, and it is merely reminding you of this fact.

> **Comments:**
> **username_0**: Thank you for the answer. I'd recommend Satoshi Labs to include this information in their instructions so newbies don't panic :)  

---

