This question is triggered by an email from Microsoft this morning about a security bulletin. It started with
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
and ended with a PGP signature.
I've seen this before but hadn't given it much thought previously. But upon reflection I have no idea if this email is actually from Microsoft (I'm sure it is, but bear with me).
How does one go about verifying a message like this? To start with, I was able to find Microsoft's Security Center public key here:
I presume this is the public key that I could use to authenticate the message I received (and validate it). This being so, HOW do I do it? There's got to be freely available software out there to enable this task, but which should I use? Or perhaps is there a dynamic link library out there somewhere that I could use to do such authentication and validation programmatically?