How do I verify an address with GPG and Sign a bitcoin txid with a sending key as proof I sent bitcoin?

Question

I was looking at donating Bitcoin to the Free Software Foundation and took a look at their PGP signed message here. However, I have three questions regarding the signed message.

1.) While I was reading the message I saw the text below saying to "verify each address, line and signature." How would one go about verifying these?

The following lines containing each address, owner and date are signed
by their respective private keys, suggesting that they are valid,
controlled by the FSF and this GPG message signer attests that they
are to be used for donations. Please use each client software to
verify each address, line and signature.

1PC9aZC4hNX2rmmrt7uHTfYAS3hRbph4UN [email protected] 20130802
pG+OoJaENOBvY2rPqB8s8Vssmb+/aw7SgE/2TLtZVmtVO8be5eYBXt4CTqbQo0YzcN97eGz8Fv8GpaqhdV2NgrfI=

2.) If I were to send some bitcoins to the Free Software Foundation and would like for them to know they came from me, I would have to provide some sort of proof. The following excerpt from the message says how to do this; however, I still do not quite understand how to execute this:

Request Receipt of Donation
===========================

If you would like for us to know who the contribution came from, and
to be able to acknowledge receipt of your donation, then please email
<[email protected]> with your name, mailing address, and contribution
info including your txid. Signing your txid with one of the sending
keys as visible in the block explorer is optional but it can serve as
proof that your contribution really came from you.

We are a 501(c)(3) charity.

I know that the txid is a unique id of the transaction and hash, but how what would a "sending key" be? How would I then proceed to sign the txid with the sending key?

3.) I used Gpg4win to verify the whole message by importing John Sullivan's GPG public key from here and clicking the "Verify" button. But how does this work and what purpose does the PGP signature at the bottom of the message serve?

Answer 1

1.) While I was reading the message I saw the text below saying to "verify each address, line and signature." How would one go about verifying these?

Your Bitcoin wallet software should have an option to verify a message. For example, in Bitcoin Core, you go to File > Verify Message and a dialog appears where you can enter the address, message and signature. In whatever verify message window, enter the address, message (the line containing the address, email, and date), and signature (the line after the address). Then click "Verify". The software will then check whether the signature verifies.

If the signature does verify, this means that the owner of the private key for that address actually made the statement that is the message AND that the message was not tampered with in any way.

2.) If I were to send some bitcoins to the Free Software Foundation and would like for them to know they came from me, I would have to provide some sort of proof. The following excerpt from the message says how to do this; however, I still do not quite understand how to execute this:

When you send Bitcoin to someone, your transaction will "send from" some addresses (it doesn't actually send from any addresses, that's now how Bitcoin work). If you look at the transaction details in a block explorer, you will see something labeled as the inputs and a list of addresses. Those addresses are what are referred to on the website as "sending keys". Those addresses should all be from your wallet.

So what you should do is get the transaction ID of the transaction, find an address that is listed as one of the inputs of the transaction, and then use your wallet software to sign a message (the txid) with that address. You then email that message, the address you signed it with, and the signature, to the FSF. Your signed message can be more than just the txid, it can have any text that you want so you can include things like your name, mailing address, and contribution info.

3.) I used Gpg4win to verify the whole message by importing John Sullivan's GPG public key from here and clicking the "Verify" button. But how does this work and what purpose does the PGP signature at the bottom of the message serve?

The PGP signature does two things: it proves that the owner ofthe PGP key (John Sullivan) actually made that statement (or at least knows of its existence) and it verifies that the statement itself was not tampered with.

This verification, combined with verifying the address and it's signature earlier, prove that John Sullivan has control over those addresses (because he provided a signature with those addresses and he signed both the addresses and their signatures with his own PGP key). Thus if you send Bitcoin to that address, John will receive the Bitcoin.

---

For more and better info on what a signature means, I suggest you read the wikipedia page on Digital Signatures.