Updating Electrum on Tails

[Pinhooo]

Hey guys I'm really hoping someone genuine can help us out here I was reading through - https://blog.thestever.net/2019/02/26/upgrading-electrum-on-tails-to-3-3-4/#comments

on how to update electrum on tails but I came across the public key to be dodgy 'animazing@gmail.com' What is Thomas V's verified email address?

Really struggling to update my electrum here

[Pinhooo]

Could someone please verify that this fingerprint is correct and is the thomas himself?

9914 864D FC33 499C 6CA2
BEEA 2245 3004 6955 06FD

[Pinhooo]

I have found that he is the signer of electrum software?

Electrum:
Signer: ThomasV thomasv1@gmx.de
Fingerprint: 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6
Key ID: 7F9470E6
Keyserver: pool.sks-keyservers.net
Signer: Animazing animazing@gmail.com
Fingerprint: 9914 864D FC33 499C 6CA2 BEEA 2245 3004 6955 06FD
Key ID: 695506FD
Keyserver: pool.sks-keyservers.net

How ever I go to sign it but it says it is dodgy. Does this mean that I have a rogue version of electrum. It was sourced straight from their website

[SomberNight]

How ever I go to sign it but it says it is dodgy

Why, what does it say?

Maybe see https://www.reddit.com/r/Electrum/comments/b1hep6/how_do_i_not_loose_my_bitcoin_with_electrum/eilpsks

Could someone please verify that this fingerprint is correct and is the thomas himself?
9914 864D FC33 499C 6CA2 BEEA 2245 3004 6955 06FD

No, that key is owned by Animazing, who used to work on Electrum a few years ago. He used to sign the MacOS builds at some point.
I am not sure why the two keys are both included in the ThomasV.asc file, I guess it was for convenience reasons when Animazing was also signing official binaries.

[SomberNight]

The point is, if after verifying you get the following, you're good:

gpg: using RSA key 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6
gpg: Good signature from "Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>" [unknown]
...
Primary key fingerprint: 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6

[Pinhooo]

I haven't received this it said it was a bad signature? So where do I go from there?

[Pinhooo]

Appreciate your reply mate

[SomberNight]

I haven't received this it said it was a bad signature? So where do I go from there?

You did not say this before.
Paste exactly what command you are running to verify the signature, and its output.

[Pinhooo]

I am simply just right clicking the app image and opening with the ThomasV.Key file when it runs the following comes up 'bad or forged signature'

[AbdussamadA]

looks like you didn't download the signature. use this script instead.

[19hundreds]

I think that the idea of merging two public keys in one is very bad. Why not simply to list all the single public keys to import? I spent an hour googling to understand who's animazing@gmail.com ...

[19hundreds]

People who landed here might be interested in this reddit post as well