Sorry to be dense, but what do we do with the ".asc" signature file to verify the authenticity?
Well true, and that is why you use GPGshell. In fact a new version, v3.02 of it has not long been released. btw if you re-read my posting above, it is very easy to install both GnuPG and GPGshell.TreeHead said:;gnupg is not as mature a client for windows as some other distros. you'll need to install a gui on top of it in order to use it well.
Ah yes but unfortunately no version prior to v8 of PGP will work properly on WindowsXP, and as most people know v8 of PGP Freeware is extremely crippled in as to what you can and cannot do with it, plus it can only be used for "personal" use. There are no limitations with GnuPG + GPGshell combo.