Valid, unverified/verified signatures

[Brian Candler]

On 17/10/2026 06:36, Lars Noodén via openssh-unix-dev wrote:
> As shown the verification is good, but there is a debug warning about 
> the signature being unverified.  Where should I read more about the 
> verification process? 

There's the source code: 
https://github.com/openssh/openssh-portable/blob/V_10_6_P1/ssh-keygen.c#L2831-L2869

As far as I can see, the debug message you refer to is printed 
unconditionally. The steps are:

- read the signature
- dearmor the signature
- verify the signature
- convert the signing key to fingerprint (just for the following debug 
message: it's freed immediately afterwards)
- print the debug message you quoted, including the fingerprint
- check if the key has been revoked
- check if the key is in allowed_keys (if supplied)
- if we get all this way through, then return success

The question then is why the debug message was worded in that way, i.e. 
the signature is always reported as "valid" but "unverified". It appears 
to have been present with that wording since commit 2a9c9f7 in 2019 when 
signing was introduced.

The commit message says:

     Signatures embed the key used to make them. At verification time, this
     is matched via principal name against an authorized_keys-like list
     of allowed signers.

This suggests to me that that "verified" is intended to mean "in the 
list of allowed signers (if supplied)". The debug message you quote is 
printed before the allowed_keys are checked, so is "unverified" at that 
point, but is verified in a later step. There is no successful signature 
verification path that avoids this debug message.

In short: just don't worry about it :-)