posted by VaelMail · 15 November 2026
What Is a Warrant Canary? How to Check VaelMail's
A warrant canary is a dated, signed statement that a service renews on a schedule. What VaelMail's says, how to verify the signature, and what it cannot prove.
A warrant canary is a statement that a service publishes and renews on a schedule. It says, in effect, that something has not happened. If the statement stops being renewed, readers have a reason to ask why. VaelMail publishes one, signed with an OpenPGP key.
What the statement says
VaelMail's canary covers three claims: that it has not received secret legal demands, that it has not been compelled to add a backdoor, and that it is not under government control. Each month the operator reviews all three before a new statement is signed and published. If any claim were no longer accurate, the statement would not be renewed.
Where to find it
The current statement is at vaelmail.com/canary. The page shows whether the statement is current or expired, the signing key and its fingerprint, and the publication history.
How to verify the signature
Download the public key from
/keys/vael-support.asc.Check its fingerprint against the one on the canary page. The fingerprint is 0E4339F7A5716E890D525BE73EEFE0E435171112.
Import the key with GnuPG:
gpg --import vael-support.asc.Download the current statement from
/canary/current.ascand rungpg --verify current.asc.
A good signature from the matching key means the statement is authentic and unchanged.
What a valid signature does and does not prove
It proves the statement came from the holder of that key and has not been altered. It does not prove that the claims are true. A canary is an attestation, not proof, and it only helps if you check it. Treat a missing renewal as a reason to ask questions, not as a conclusion.
What happens if it expires
The canary page marks an expired statement visibly instead of hiding it. An expired statement does not mean something has happened, because it can also be a missed renewal. It does mean you should not rely on it until it is renewed.
Why a canary at all
A service cannot always say that it has received a demand, because some demands come with a ban on telling anyone. A canary lets the absence of the statement carry the message. It is one transparency measure among several. The changelog records security changes as they ship, and the security page explains what each protection does and where it stops.
Related
For what VaelMail stores and for how long, read what we store, and why and the privacy policy.
In short
VaelMail's canary is a monthly, PGP-signed statement that you can verify with the published key and fingerprint. A valid signature proves who wrote it and that it is unchanged, a lapse is a reason to ask questions, and neither is proof about the claims themselves.
