The first seems more important (no sense going through all the work of verifying something is true before making sure the authors are actually stating it!), but

The first seems more important (no sense going through all the work of verifying something is true before making sure the authors are actually stating it!), but, both, really. In the latter case, you'd look at the software that /you/ run to validate that: 1. It's using some sane form of key generation. 2. It's actually using those keys to perform encryption on the files prior to them being transmitted. 3. The original files, as well as the key material, aren't read anywhere else in the code base not necessary to do the above two. Then, only run that version of the software. It's non-trivial, and generally expensive. This is why a lot of people prefer tools which call out to other trusted programs to actually handle the key management and encryption. Less complicated code to audit that way. (cf tarsnap)