# ungovernable.tech

> An independent library of the tools, protocols and cryptography that keep people private, connected and sovereign: from Tor and mesh radios to zero-knowledge proofs and post-quantum keys. Every entry says what it protects against, what it trusts, and how ready it is.

Readiness scale: battle-tested, usable, experimental, research, historical, cautionary. See [/method/](https://ungovernable.tech/method/) for the full definitions.

## Pillars
- [Anonymity Networks](https://ungovernable.tech/pillars/anonymity/): Encryption hides what you say; anonymity networks hide that you said it. Onion routing, garlic routing and mix networks, from Tor's three hops to cover-traffic mixnets built to resist a global passive adversary.
- [Censorship Circumvention](https://ungovernable.tech/pillars/circumvention/): Censors block IPs, poison DNS, fingerprint protocols and shut networks down entirely. These are the tools and techniques that keep people connected anyway, and the trade-offs each one makes.
- [Secure Messaging](https://ungovernable.tech/pillars/messaging/): End-to-end encryption is now table stakes. The real differences are identifiers, metadata, servers and who can be compelled to hand over what. Protocols, apps and how to choose between them.
- [Off-Grid and Mesh Networks](https://ungovernable.tech/pillars/mesh/): LoRa meshes, Bluetooth meshes, packet radio, HF data modes and overlay networks that route around central infrastructure, or do without it.
- [Sovereign Naming](https://ungovernable.tech/pillars/naming/): DNS is a chokepoint: registrars, registries and resolvers can all be ordered to take a name down. Self-authenticating names, blockchain registries and key-rooted alternatives, with an honest look at which ones are sovereign and which only look it.
- [Identity, Social and Trust](https://ungovernable.tech/pillars/identity/): Keys instead of accounts. Nostr, AT Protocol, DIDs, verifiable credentials, remote signers and webs of trust, plus the hard part, which is recovering when keys are lost.
- [Financial Sovereignty](https://ungovernable.tech/pillars/money/): Self-custody, your own node, payment privacy, ecash and peer-to-peer markets. Money that cannot be frozen, and the operational discipline it requires.
- [Decentralized Storage](https://ungovernable.tech/pillars/storage/): Content-addressed and replicated storage networks, permanent archives and simple key-authenticated blob servers, and what each one actually guarantees.
- [Decentralized Compute](https://ungovernable.tech/pillars/compute/): GPU marketplaces, compute-over-data, decentralized training and verifiable execution. What is real capacity, what is token theatre, and how trust is (or is not) handled.
- [Confidential Computing](https://ungovernable.tech/pillars/confidential/): Trusted execution environments such as Intel TDX, AMD SEV-SNP, Arm CCA and NVIDIA GPU TEEs, remote attestation, and the side channels that keep breaking them.
- [Privacy-Enhancing Cryptography](https://ungovernable.tech/pillars/cryptography/): Fully homomorphic encryption, multi-party computation, private information retrieval, private set intersection, threshold signatures and the primitives underneath them. Math instead of trust.
- [Zero-Knowledge Proofs](https://ungovernable.tech/pillars/zk/): SNARKs, STARKs, folding, polynomial commitments, and what they enable, from anonymous credentials and private payments to proofs about email and machine learning.
- [Post-Quantum Cryptography](https://ungovernable.tech/pillars/pqc/): ML-KEM, ML-DSA, SLH-DSA, FN-DSA and HQC, hybrid migration, and what "harvest now, decrypt later" means for anything you encrypt today.
- [Devices and Operational Security](https://ungovernable.tech/pillars/endpoint/): Every protocol on this site fails if the endpoint is compromised. Threat modeling, hardened phones, amnesic and compartmentalized operating systems, browsers, file encryption and the habits that hold it all together.

## Guides
- [Bitcoin Self-Custody, Step by Step](https://ungovernable.tech/guides/bitcoin-self-custody/): How to hold bitcoin that nobody can freeze: a hardware signer, your own node, a tested seed backup, multisig for larger amounts, and habits that protect privacy.
- [Build a community Wi-Fi network](https://ungovernable.tech/guides/community-wifi-network/): Plan a small community Wi-Fi network with OpenWrt and LibreMesh, including hardware checks, backhaul, shared administration and outage tests.
- [Building a Local Mesh Network](https://ungovernable.tech/guides/building-a-mesh/): How to set up LoRa radios with Meshtastic or MeshCore for off-grid text messaging: choosing hardware, flashing firmware, private channels, placement and privacy.
- [Building a ZK membership proof](https://ungovernable.tech/guides/building-a-zk-membership-proof/): Build a Semaphore v4 membership proof, verify its group and scope, reject repeat submissions, and understand which inputs remain private.
- [Choosing a Secure Messenger](https://ungovernable.tech/guides/choosing-a-secure-messenger/): Signal, SimpleX, Session, Briar, Cwtch, Matrix and others compared by what they actually protect: content, identifiers, metadata and availability.
- [Deploying on decentralized compute](https://ungovernable.tech/guides/deploying-on-decentralized-compute/): Deploy a container on Akash with an explicit provider lease, inspect its status, plan data recovery, and close the deployment when you leave.
- [Encrypting Files, Disks and Backups](https://ungovernable.tech/guides/encrypting-files-and-backups/): A practical guide to protecting files, disks, backups and account credentials, with recovery planning and the limits of encryption at rest.
- [Getting Around Internet Censorship](https://ungovernable.tech/guides/censorship-circumvention/): How censors block the internet, and how Tor bridges, Psiphon, Outline, Xray with REALITY, AmneziaWG and similar tools get around each kind of blocking.
- [Getting Started on Nostr Safely](https://ungovernable.tech/guides/nostr-getting-started/): Create a Nostr identity you control, keep your private key out of web apps with a signer, choose relays and clients, and understand what Nostr makes public.
- [Hardening a Phone with GrapheneOS](https://ungovernable.tech/guides/grapheneos/): Why GrapheneOS is the strongest option for a private, hardened Android phone, how to install and verify it, and which settings matter most.
- [Internet Shutdown Preparedness](https://ungovernable.tech/guides/internet-shutdown-preparedness/): What to set up before the network goes dark: offline-capable messengers, mesh radios, offline maps and knowledge, saved bridges and a plan for your group.
- [Migrating to Hybrid Key Exchange](https://ungovernable.tech/guides/hybrid-kem-migration/): A practical guide to migrating systems to post-quantum key exchange with hybrid KEMs such as X25519MLKEM768: where to start and what breaks.
- [Nostr Key Custody and Recovery](https://ungovernable.tech/guides/nostr-key-custody/): Keeping a Nostr key safe and usable for years: signers, bunkers, hardware, backups, social recovery and what to do when a key is compromised.
- [Private File Sync and Backup](https://ungovernable.tech/guides/private-file-sync-and-backup/): Replicate files across your devices with Syncthing, test an untrusted encrypted replica, and keep a separate offline archive with a recovery plan.
- [Publishing an Uncensorable Website](https://ungovernable.tech/guides/uncensorable-website/): How to publish so that no single registrar, host or government can take you offline: onion services, content-addressed mirrors, independent naming and multiple jurisdictions.
- [Reducing Tracking: Browsers, DNS and Fingerprinting](https://ungovernable.tech/guides/browser-and-network-privacy/): Practical steps against everyday tracking: choosing and hardening a browser, blocking trackers, encrypted DNS, private search and testing your fingerprint.
- [Resilient and Relocatable Infrastructure](https://ungovernable.tech/guides/resilient-infrastructure/): Running a relay, node or server that keeps working through outages, seizure and censorship: redundancy, geographic spread, encrypted backups and portability.
- [Responding to Suspected Device Compromise](https://ungovernable.tech/guides/suspected-device-compromise/): Respond to a suspected phone or computer compromise: use a trusted device, preserve evidence, seek expert help and plan account and device recovery.
- [Run a private circumvention server for people you know](https://ungovernable.tech/guides/self-hosted-circumvention-server/): Set up Outline or WireGuard for a trusted group, test routing and revocation, and compare running a Tor bridge or Snowflake proxy instead.
- [Running Infrastructure for Freedom](https://ungovernable.tech/guides/running-freedom-infrastructure/): Run a private circumvention server, a Tor bridge or a Snowflake proxy, and learn the responsibilities of operating shared infrastructure.
- [Sanitizing Documents Before Sharing](https://ungovernable.tech/guides/sanitizing-documents/): Prepare documents for sharing by checking metadata, removing sensitive content with real redaction, and reviewing filenames and the final output.
- [Tails, Qubes OS and Whonix](https://ungovernable.tech/guides/tails-qubes-whonix/): Compare Tails, Qubes OS and Whonix for different workflows, then plan installation, updates, disk encryption and separation of identities.
- [Threat Modeling for Sovereign Individuals](https://ungovernable.tech/guides/threat-modeling/): Start here. A practical way to decide what you are protecting, from whom, and which tools on this site are worth the effort for you.
- [Using Tor Safely](https://ungovernable.tech/guides/using-tor-safely/): How to install Tor Browser, connect through bridges when Tor is blocked, choose a security level and avoid the habits that deanonymise users.
- [Verify software before installing it](https://ungovernable.tech/guides/verifying-software/): Check downloads with project signing keys, understand what checksums prove, and use reproducible builds without confusing them with a security audit.
- [Verifying a confidential workload](https://ungovernable.tech/guides/verifying-a-confidential-workload/): Verify an Intel SGX workload with Gramine RA-TLS: establish expected measurements, check hardware evidence and bind secret release to the connection.

## Entries
- [ActivityPub](https://ungovernable.tech/kb/activitypub/): ActivityPub connects social servers through actors and inboxes. Learn what federation, account migration and instance moderation actually provide.
- [Aethir](https://ungovernable.tech/kb/aethir/): Aethir, an enterprise-oriented decentralized GPU cloud: how its marketplace works, who supplies the hardware, and what users actually have to trust.
- [age: Modern File Encryption](https://ungovernable.tech/kb/age-encryption/): age is a small, modern file-encryption tool built on X25519 and ChaCha20-Poly1305: how it works, how to use it, and where it beats PGP for files.
- [AI Agent Identity on Nostr](https://ungovernable.tech/kb/ai-agent-identity-nostr/): How AI agents get cryptographic identities on Nostr: key pairs for non-human actors, delegation, payments and the trust questions this raises.
- [Akash Network](https://ungovernable.tech/kb/akash/): Akash Network, an open-source decentralized cloud: a reverse-auction marketplace for container workloads and GPUs, its trust model and its limits.
- [Apple Secure Enclave (SEP)](https://ungovernable.tech/kb/apple-secure-enclave/): Apple's Secure Enclave, the isolated security processor inside every modern Apple chip: what it protects, how it is attested, and what it cannot do.
- [APRS](https://ungovernable.tech/kb/aprs/): APRS shares amateur-radio position and status packets through digipeaters and internet gateways. Understand its public data and operating limits.
- [Arm Confidential Compute Architecture (CCA)](https://ungovernable.tech/kb/arm-cca/): Arm Confidential Compute Architecture adds Realms, hardware-isolated VMs, to Arm chips: how CCA works, how it compares with TDX and SEV-SNP, and its status.
- [Arweave](https://ungovernable.tech/kb/arweave/): Arweave, a permanent storage network funded by a one-time payment: how the blockweave and endowment work, and what permanence really guarantees.
- [AT Protocol and did:plc](https://ungovernable.tech/kb/at-protocol/): Bluesky's AT Protocol identity model: portable signed repositories anchored to did:plc or did:web, and how much of it depends on Bluesky itself.
- [Authenticated Data Structures](https://ungovernable.tech/kb/authenticated-data-structures/): Merkle trees, accumulators and vector commitments: data structures that let anyone verify membership or non-membership against a short digest.
- [B.A.T.M.A.N. advanced and cjdns](https://ungovernable.tech/kb/batman-adv-and-cjdns/): Two long-running approaches to mesh routing compared: B.A.T.M.A.N. advanced for local Layer 2 meshes and cjdns for encrypted IPv6 overlay networks.
- [Bacalhau and Compute-over-Data](https://ungovernable.tech/kb/bacalhau/): Bacalhau and compute-over-data: moving jobs to where data lives instead of moving data to the compute, and how it underpins decentralized networks.
- [BBS+ Signatures](https://ungovernable.tech/kb/bbs-signatures/): BBS+ signatures let a credential holder reveal only chosen attributes and prove the rest in zero knowledge: the scheme behind private verifiable credentials.
- [Biscuit authorization tokens](https://ungovernable.tech/kb/biscuit/): Biscuit tokens combine public-key signatures with Datalog authorization. Holders can append restrictions offline, while verifiers enforce local policy.
- [Bisq](https://ungovernable.tech/kb/bisq/): Bisq exchanges bitcoin peer to peer over Tor. Compare its multisig escrow and dispute process with the seller-reputation model of Bisq Easy.
- [Bitchat](https://ungovernable.tech/kb/bitchat/): Bitchat is a phone-only messenger that relays encrypted chat over a Bluetooth mesh with no internet, and falls back to Nostr relays when a connection exists.
- [Bitcoin and the Post-Quantum Migration](https://ungovernable.tech/kb/bitcoin-post-quantum-migration/): Why a large quantum computer would break Bitcoin's signatures, which coins are most exposed, and the proposals for migrating to post-quantum keys.
- [Bittensor](https://ungovernable.tech/kb/bittensor/): Bittensor, a token-incentivised network of AI subnets where miners produce inference and validators score them: how it works and what it rewards.
- [BitTorrent for Archive Distribution](https://ungovernable.tech/kb/bittorrent-archives/): BitTorrent distributes verifiable archive copies through peers and web seeds; continued seeding supplies availability, while peer addresses remain visible.
- [BitVM](https://ungovernable.tech/kb/bitvm/): BitVM lets Bitcoin verify arbitrary computation through fraud proofs, without a soft fork: how it works, what it enables for bridges, and its costs.
- [Blockstream Satellite](https://ungovernable.tech/kb/blockstream-satellite/): Blockstream Satellite broadcasts Bitcoin data without an internet connection. Understand receiver hardware, coverage and the one-way link's limits.
- [Blossom: Blob Storage on Nostr](https://ungovernable.tech/kb/blossom/): Blossom stores files addressed by SHA-256 hash on ordinary HTTP servers, with Nostr keys for authorisation: simple, mirrorable blob storage for Nostr.
- [Briar](https://ungovernable.tech/kb/briar/): Briar is a peer-to-peer messenger built for shutdowns and hostile networks: it syncs over Tor, Bluetooth and Wi-Fi, with no servers holding your messages.
- [BTCPay Server](https://ungovernable.tech/kb/btcpay-server/): BTCPay Server accepts Bitcoin payments into your wallet. Learn how xpub invoices, self-hosting and Lightning change custody and operational trust.
- [Build a post-quantum cryptographic inventory](https://ungovernable.tech/kb/pqc-cryptographic-inventory/): Inventory protocols, libraries, keys and certificates before a post-quantum migration. Use official guidance to prioritize dependencies and data lifetimes.
- [Buzz](https://ungovernable.tech/kb/buzz/): Buzz, a self-hostable system that gives AI agents their own Nostr key pairs and identities: a production example of non-human actors on Nostr.
- [Cardano DNS](https://ungovernable.tech/kb/cardano-dns/): Cardano DNS from Blink Labs combines Handshake top-level domains with Cardano native assets: an experimental approach to blockchain-owned names.
- [Cashu and Chaumian Ecash](https://ungovernable.tech/kb/cashu-ecash/): Cashu brings Chaumian ecash to Bitcoin: blind-signed bearer tokens that give near-cash payment privacy, in exchange for trusting the mint with custody.
- [Choosing a private messenger](https://ungovernable.tech/kb/compare-messengers/): Compare private messengers by identifiers, servers, metadata, encryption defaults, offline operation and readiness, including the limits of radio meshes.
- [Choosing Decentralized Storage](https://ungovernable.tech/kb/compare-storage/): Compare IPFS, Filecoin, Arweave, Tahoe-LAFS, Syncthing, BitTorrent, Hypercore and Blossom by retention, privacy, updates and operating obligations.
- [CoinJoin and Payjoin](https://ungovernable.tech/kb/coinjoin/): CoinJoin and Payjoin break the assumption that all inputs of a Bitcoin transaction belong to one person: implementations, trade-offs and legal context.
- [Community Networks](https://ungovernable.tech/kb/community-networks/): Internet access can be built and owned by the people who use it. How community networks like Guifi.net, Freifunk and NYC Mesh work, and how to start one.
- [Compare decentralized compute platforms](https://ungovernable.tech/kb/compare-decentralized-compute/): Compare compute platforms by customer access, provider admission, payments, workloads and attestation, separating documented controls from unverified claims.
- [Compare fully homomorphic encryption libraries](https://ungovernable.tech/kb/compare-fhe-libraries/): Compare OpenFHE, TFHE-rs, Microsoft SEAL, Lattigo and HElib by schemes, implementation language, license and documented bootstrapping support.
- [Compare: Peer-to-Peer Bitcoin Acquisition](https://ungovernable.tech/kb/compare-p2p-bitcoin-acquisition/): Compare Bisq, RoboSats, Hodl Hodl, Peach and atomic swaps by custody, identity checks, payment privacy, fiat rails and practical readiness.
- [Concord Protocol](https://ungovernable.tech/kb/concord-protocol/): Concord, an open MIT-licensed specification for end-to-end encrypted communities on Nostr: its design, how it uses MLS ideas, and its maturity.
- [Confidential AI Inference](https://ungovernable.tech/kb/confidential-ai-inference/): Running AI inference so the provider cannot see your prompts and you cannot see the model weights: confidential GPUs, attestation and their limits.
- [Confidential Computing](https://ungovernable.tech/kb/confidential-computing/): Confidential computing protects data while it is being processed, using hardware TEEs and remote attestation. What it protects, and what it trusts.
- [Confidential Computing Across Cloud Providers](https://ungovernable.tech/kb/confidential-cloud-comparison/): Confidential computing across AWS, Azure, Google Cloud and others: which silicon each uses, what attestation you get, and what the marketing omits.
- [Confidential Containers (CoCo)](https://ungovernable.tech/kb/confidential-containers/): Confidential Containers (CoCo) runs Kubernetes pods inside confidential VMs with attestation and key release: architecture, components and caveats.
- [Confidential Data Vending Machines](https://ungovernable.tech/kb/confidential-dvm/): An open research note on running Nostr Data Vending Machine jobs inside confidential containers, so a provider can process private data it can never see.
- [Cordn](https://ungovernable.tech/kb/cordn/): Cordn is MLS group messaging run through a coordinator you can self-host anywhere, reached over Nostr relays via ContextVM, with Nostr keys as identity.
- [Cover Traffic and Constant-Rate Padding](https://ungovernable.tech/kb/cover-traffic/): Encryption hides message contents, not the pattern of sending. Cover traffic and constant-rate padding hide that pattern from an observer watching the wire, at a cost.
- [CryptPad](https://ungovernable.tech/kb/cryptpad/): CryptPad encrypts collaborative documents in the browser. Understand instance metadata, sharing-link trust and the responsibilities of self-hosting.
- [Cwtch](https://ungovernable.tech/kb/cwtch/): Cwtch, from Open Privacy, builds metadata-resistant one-to-one and group messaging on Tor onion services, with no central servers learning who talks.
- [Dangerzone](https://ungovernable.tech/kb/dangerzone/): Dangerzone rebuilds untrusted documents as PDFs through an isolated conversion process. What the sandbox removes, what it trusts, and its limits.
- [Decentralized Compute](https://ungovernable.tech/kb/decentralized-compute/): Permissionless markets for CPU and GPU time: how decentralized compute networks work, how they handle trust, and where capacity is real or token-driven.
- [Decentralized DNS and Sovereign Naming](https://ungovernable.tech/kb/decentralized-dns/): Naming without ICANN, registrars or certificate authorities: blockchain registries, key-rooted names and overlay names compared by how sovereign they are.
- [Decentralized Identifier (DID) Methods](https://ungovernable.tech/kb/did-methods/): A practical look at the decentralized identifier methods worth taking seriously, from did:key and did:web to did:plc, and what each one trades off.
- [Decentralized Identity](https://ungovernable.tech/kb/decentralized-identity/): Identifiers, credentials and reputation that belong to the user rather than a platform: DIDs, verifiable credentials and key-based identity explained.
- [Decentralized Storage](https://ungovernable.tech/kb/decentralized-storage/): Storage that survives platform failure, account seizure and takedowns: IPFS, Filecoin, Arweave, Sia, Storj, Swarm and Blossom compared by guarantees.
- [Decentralized Training](https://ungovernable.tech/kb/decentralized-training/): Training large AI models across distributed, heterogeneous hardware over the internet: the techniques, the bandwidth problem and the projects trying it.
- [Defending Against a Global Passive Adversary](https://ungovernable.tech/kb/global-passive-adversary/): What it takes to defeat an adversary who can watch the whole network: traffic correlation, cover traffic, mixing and the research frontier.
- [Delay-tolerant networking](https://ungovernable.tech/kb/delay-tolerant-networking/): Delay-tolerant networks store messages across broken links. Compare Bundle Protocol v7, BPSec and the separate delivery designs of offline messengers.
- [Delta Chat](https://ungovernable.tech/kb/delta-chat/): Delta Chat carries encrypted conversations over email protocols. Learn what chatmail guarantees, what mail servers see, and where protection ends.
- [DNNS](https://ungovernable.tech/kb/dnns/): DNNS is Lithosphere’s experimental on-chain naming application: public contracts, the Kamet testnet interface and its trust limits.
- [DNSCrypt and dnscrypt-proxy](https://ungovernable.tech/kb/dnscrypt/): DNSCrypt encrypts DNS queries to a resolver. Compare direct resolution, anonymized relays and the DoH and ODoH support in dnscrypt-proxy.
- [drand and tlock](https://ungovernable.tech/kb/drand-tlock/): drand supplies threshold-signed randomness; tlock encrypts to a future beacon round. Understand early-release trust, availability and public decryption.
- [Encrypted Messaging](https://ungovernable.tech/kb/encrypted-messaging/): How end-to-end encrypted messaging works, what it protects, and why identifiers, servers and metadata decide how private a messenger really is.
- [ENS as Identity](https://ungovernable.tech/kb/ens-identity/): Using the Ethereum Name Service as an identity layer: names as accounts, records for keys and profiles, and the dependencies that come with it.
- [Ethereum Name Service (ENS)](https://ungovernable.tech/kb/ens/): The Ethereum Name Service, the largest deployed blockchain naming system: how registration and resolution work, and how it bridges to ordinary DNS.
- [Fedimint](https://ungovernable.tech/kb/fedimint/): Fedimint combines federated Bitcoin custody with Chaumian ecash. Learn what guardians control, how Lightning gateways work and what users trust.
- [FHE Bootstrapping and Verification](https://ungovernable.tech/kb/fhe-bootstrapping-and-verification/): Two problems that shape every real FHE deployment: bootstrapping to compute deeply on ciphertexts, and verifying that the server computed honestly.
- [Financial Sovereignty](https://ungovernable.tech/kb/financial-sovereignty/): Controlling your own money without banks or intermediaries: self-custody, running a node, payment privacy, ecash and censorship-resistant payments.
- [FIPS (Free Internetworking Peering System)](https://ungovernable.tech/kb/fips-mesh/): FIPS, a Rust mesh routing protocol that uses Nostr key pairs as node identities: how it routes, what it encrypts, and its experimental status.
- [Fluence](https://ungovernable.tech/kb/fluence/): Fluence, a decentralized marketplace for virtual servers and GPU containers run by independent providers: how it works and what you trust.
- [FN-DSA (Falcon)](https://ungovernable.tech/kb/fn-dsa-falcon/): FN-DSA (Falcon), the compact lattice signature scheme being standardised as FIPS 206: how it works, its implementation pitfalls and its status.
- [Folding Schemes](https://ungovernable.tech/kb/folding-schemes/): Folding schemes such as Nova combine many instances of a computation into one claim, making incremental and recursive zero-knowledge proofs cheap.
- [Fully Homomorphic Encryption](https://ungovernable.tech/kb/fully-homomorphic-encryption/): Fully homomorphic encryption lets a server compute on encrypted data without decrypting it: how it works, the main schemes, libraries and costs.
- [General-purpose zkVMs](https://ungovernable.tech/kb/zkvms/): Compare RISC Zero and SP1: program identity, public outputs, private witnesses, proof modes, and the privacy cost of outsourcing proof generation.
- [GNU Name System (GNS)](https://ungovernable.tech/kb/gnu-name-system/): The GNU Name System resolves petname-based, privacy-preserving names through GNUnet's distributed hash table, with no central root. How and why.
- [Golem Network](https://ungovernable.tech/kb/golem/): Golem, one of the oldest decentralized compute markets: a two-sided marketplace for general-purpose computation and what years of operation show.
- [Gonka](https://ungovernable.tech/kb/gonka/): Gonka, an experimental Layer 1 that redesigns proof-of-work around transformer computation so that mining produces useful AI inference.
- [Gramine](https://ungovernable.tech/kb/gramine/): Gramine runs Linux applications in Intel SGX enclaves. Learn how manifests, trusted files and remote attestation define its security boundary.
- [Handshake](https://ungovernable.tech/kb/handshake/): Handshake replaces the DNS root zone with a permissionless blockchain auction of top-level domains: how it works, how to resolve names, and its adoption.
- [Hardware and Firmware Supply-Chain Trust](https://ungovernable.tech/kb/hardware-supply-chain-trust/): Assess the hardware and firmware beneath your operating system, with measured boot, open firmware and explicit limits on what those checks establish.
- [Hardware Wallets](https://ungovernable.tech/kb/hardware-wallets/): Hardware wallets keep private keys on a dedicated device and confirm transactions on a trusted screen: architectures, threat model and trade-offs.
- [Heads Firmware](https://ungovernable.tech/kb/heads-firmware/): Heads combines open boot firmware with integrity checks. Understand TPM measurements, TOTP and HOTP verification, hardware support and limits.
- [HF Radio Data Modes](https://ungovernable.tech/kb/hf-data-modes/): Text and email over shortwave radio, from Winlink to JS8Call and VARA: continental links that survive when the internet and local networks fail.
- [HOPR](https://ungovernable.tech/kb/hopr/): HOPR, an incentivised mix network that pays relays per packet: Sphinx onion routing, proof of relay, cover traffic and its deployment status.
- [HORNET](https://ungovernable.tech/kb/hornet/): HORNET, a research design for high-speed onion routing at the network layer: how it reaches line-rate anonymity, and why it was never deployed.
- [HQC](https://ungovernable.tech/kb/hqc/): HQC, the code-based key encapsulation mechanism NIST selected in 2025 as a backup to ML-KEM: how it works, its sizes and standardisation timeline.
- [Hypercore and Hyperdrive](https://ungovernable.tech/kb/hypercore/): Hypercore verifies replicated logs with signed Merkle trees; Hyperdrive adds files and Hyperswarm connects peers, with retention left to operators.
- [Hyphanet and Freenet](https://ungovernable.tech/kb/hyphanet-and-freenet/): Hyphanet (the original Freenet) is a long-running anonymous publishing network built on a distributed, encrypted store. How it works and its limits.
- [I2P (Invisible Internet Project)](https://ungovernable.tech/kb/i2p/): I2P, the Invisible Internet Project: an anonymous overlay network optimised for hidden services, with garlic routing and every user a router.
- [IBM Secure Execution (LinuxONE / Z)](https://ungovernable.tech/kb/ibm-secure-execution/): IBM Secure Execution brings confidential VMs to IBM Z and LinuxONE mainframes: architecture, attestation and how it compares with x86 TEEs.
- [Identity and Pseudonymity](https://ungovernable.tech/kb/identity-and-pseudonymity/): Identity rooted in cryptographic keys instead of institutions: why pseudonymity matters, how identities get linked, and how to keep them apart.
- [io.net](https://ungovernable.tech/kb/io-net/): io.net aggregates GPUs from data centres and individuals into an AI compute marketplace: how it works, what it offers and how trust is handled.
- [IPFS and Filecoin](https://ungovernable.tech/kb/ipfs-and-filecoin/): IPFS gives data a content address that anyone can serve; Filecoin pays providers to store it and prove they do. How the pair works and fails.
- [IPNS and DNSLink](https://ungovernable.tech/kb/ipns-dnslink/): IPNS signs mutable pointers to IPFS content, while DNSLink publishes paths in DNS TXT records; both need available content and careful name management.
- [Jami](https://ungovernable.tech/kb/jami/): Jami uses distributed discovery and device-held identities for calls and chat. Explore OpenDHT, encrypted connections, swarm history and network limits.
- [Katzenpost](https://ungovernable.tech/kb/katzenpost/): Katzenpost, a post-quantum mix network based on Loopix with hybrid key exchange built in: design, threat model and deployment status.
- [KERI (Key Event Receipt Infrastructure)](https://ungovernable.tech/kb/keri/): KERI builds self-certifying identifiers with pre-rotated keys, so a stolen signing key does not mean a stolen identity. How it works and where it is used.
- [Kiwix](https://ungovernable.tech/kb/kiwix/): Kiwix reads Wikipedia and other ZIM archives offline, while kiwix-serve shares a local library with browsers during outages or shutdowns.
- [LibreMesh](https://ungovernable.tech/kb/libremesh/): LibreMesh builds community mesh firmware on OpenWrt. Learn how BATMAN-adv and Babel connect routers, and what network operators must manage.
- [Lightning Network](https://ungovernable.tech/kb/lightning-network/): The Lightning Network makes Bitcoin payments instant and cheap through payment channels and onion-routed HTLCs: how it works and what it reveals.
- [Local-first Software and CRDTs](https://ungovernable.tech/kb/local-first-crdts/): Local-first software keeps working data on your device; CRDTs merge concurrent edits, while encryption and access control remain separate choices.
- [Loopix](https://ungovernable.tech/kb/loopix/): Loopix, the 2017 design that revived mix networks with continuous-time mixing and three kinds of cover traffic, and the basis of Nym and Katzenpost.
- [Magic Wormhole](https://ungovernable.tech/kb/magic-wormhole/): Magic Wormhole transfers files using a short shared code. Understand PAKE authentication, mailbox coordination and transit relay trust.
- [Map: Censorship Resistance](https://ungovernable.tech/kb/map-censorship-resistance/): A map of censorship resistance across the stack: naming, storage, transport, messaging and publishing, and how the pieces in this library combine.
- [Map: Composing Primitives](https://ungovernable.tech/kb/map-composing-primitives/): A map for building real systems by combining primitives: TEEs with attestation, mixnets with ecash, ZK with identity, and where compositions fail.
- [Map: Metadata Privacy](https://ungovernable.tech/kb/map-metadata-privacy/): A map of metadata privacy: hiding who, when, where, how often and how much, which often reveals more than the content of communications.
- [Map: Threat Models](https://ungovernable.tech/kb/map-threat-models/): A map of the recurring adversaries, trust assumptions and failure modes across this library, from cloud operators to quantum computers.
- [Marlin Oyster](https://ungovernable.tech/kb/marlin-oyster/): Marlin Oyster, a decentralized confidential computing network offering TEE-backed virtual machines and serverless functions: design and trust model.
- [Marmot: MLS over Nostr](https://ungovernable.tech/kb/marmot-protocol/): Marmot layers MLS (RFC 9420) group encryption on Nostr identities and relays: end-to-end encrypted group chat without phone numbers or central servers.
- [Matrix and End-to-End Encryption](https://ungovernable.tech/kb/matrix/): Matrix, the federated communication protocol behind Element: how its end-to-end encryption works, and the metadata that federation exposes.
- [Merkle Tree Certificates](https://ungovernable.tech/kb/merkle-tree-certificates/): Merkle Tree Certificates batch many TLS certificates into one signed tree, keeping certificates small enough for post-quantum signatures.
- [MeshCore](https://ungovernable.tech/kb/meshcore/): MeshCore turns inexpensive LoRa boards into an off-grid text mesh with dedicated repeaters and learned direct routes. How it works and how it differs from Meshtastic.
- [Meshtastic](https://ungovernable.tech/kb/meshtastic/): Meshtastic turns inexpensive LoRa boards into an encrypted, self-organising text mesh with kilometres of range and no infrastructure. How it works.
- [Metadata Resistance](https://ungovernable.tech/kb/metadata-resistance/): Encryption hides what you say; metadata resistance hides whom you said it to, when and how often. Techniques, systems and their trade-offs.
- [Mix Networks](https://ungovernable.tech/kb/mix-networks/): Mix networks and onion routing explained: how anonymity systems defeat traffic analysis, from Tor's three hops to cover-traffic mixnets.
- [Mix Networks Research and Deployment Tracker](https://ungovernable.tech/kb/mix-networks-tracker/): A tracker of deployed and near-deployed anonymity networks and mixnet research: Tor, I2P, Nym, Katzenpost, HOPR and the papers behind them.
- [Mixminion and Mixmaster](https://ungovernable.tech/kb/mixminion-and-mixmaster/): Mixmaster and Mixminion, the anonymous remailer networks that ran for two decades: how they worked, why they faded, and the lessons they left.
- [ML-DSA (FIPS 204)](https://ungovernable.tech/kb/ml-dsa/): ML-DSA (FIPS 204), NIST's primary post-quantum signature standard: how the lattice scheme works, its parameter sets, sizes and deployment.
- [ML-KEM (FIPS 203)](https://ungovernable.tech/kb/ml-kem/): ML-KEM (FIPS 203), NIST's post-quantum key encapsulation standard: how it works, its parameter sets, and its use in hybrid TLS key exchange.
- [MLS (RFC 9420) and Wire](https://ungovernable.tech/kb/mls-wire/): Messaging Layer Security (RFC 9420) brings efficient end-to-end encryption to large groups. How MLS works and how Wire deploys it in production.
- [Mobile location privacy](https://ungovernable.tech/kb/mobile-location-privacy/): Understand subscriber and device identifiers, cell-site location, Wi-Fi and Bluetooth address randomization, airplane mode and radio shielding limits.
- [Monero](https://ungovernable.tech/kb/monero/): How Monero hides senders, receivers and amounts by default with ring signatures, stealth addresses and RingCT, where its privacy has limits, and how to use it well.
- [Mullvad VPN](https://ungovernable.tech/kb/mullvad-vpn/): Mullvad uses numbered accounts and WireGuard tunnels. Examine payment records, published audits, multihop routing and DAITA limitations.
- [Multi-Party Computation](https://ungovernable.tech/kb/multi-party-computation/): Secure multi-party computation lets parties compute a function over their private inputs while learning nothing else: protocols, tools and uses.
- [Namecoin](https://ungovernable.tech/kb/namecoin/): Namecoin, the first fork of Bitcoin and the first blockchain naming system: how .bit names work, what it got right, and why adoption stayed small.
- [Naming on Mesh and Off-Grid Networks](https://ungovernable.tech/kb/mesh-naming/): How mesh and off-grid networks name things without the global DNS: key-derived addresses, local registries and naming on Yggdrasil, cjdns and Reticulum.
- [Naming systems compared](https://ungovernable.tech/kb/compare-naming-systems/): Compare ENS, Handshake, Namecoin, GNS, Pkarr, onion names and DNS: renewal, resolution, key recovery and the places censorship can still act.
- [Nomen](https://ungovernable.tech/kb/nomen/): Nomen, a small decentralized naming protocol that combines Bitcoin for ownership with Nostr for records: how it works and its experimental status.
- [Nostr as an Identity Layer](https://ungovernable.tech/kb/nostr-identity/): On Nostr an identity is just a secp256k1 key pair: no registrar, platform or issuer. How keys, names, verification and delegation work.
- [Nostr VPN](https://ungovernable.tech/kb/nostr-vpn/): Nostr VPN, a Tailscale-style private mesh network that uses Nostr keys for identity and WireGuard for transport: design and experimental status.
- [Nostr: The Protocol](https://ungovernable.tech/kb/nostr-protocol/): Nostr, a minimal protocol of signed events and relays with no accounts: how it works, why it resists censorship, and its weak points.
- [NVIDIA GPU TEEs](https://ungovernable.tech/kb/nvidia-gpu-tee/): NVIDIA's GPU confidential computing on Hopper and Blackwell: how the GPU TEE, encrypted transfers and attestation work, and what remains trusted.
- [Nym Mixnet](https://ungovernable.tech/kb/nym/): Nym, a deployed mixnet based on Loopix with cover traffic and incentivised nodes, designed to resist a global passive adversary. Design and status.
- [Oblivious HTTP and DNS](https://ungovernable.tech/kb/oblivious-http/): Oblivious HTTP and Oblivious DNS over HTTPS separate a client's address from request contents, provided the relay and gateway do not collude.
- [Oblivious RAM](https://ungovernable.tech/kb/oblivious-ram/): Oblivious RAM hides storage access patterns, including repeated reads and writes. Learn Path ORAM's design and how it differs from PIR and TEEs.
- [Off-grid communication compared](https://ungovernable.tech/kb/compare-off-grid/): Compare Meshtastic and MeshCore beside Reticulum, Briar, Bitchat, HF data and satellite IoT by reach, capacity, hardware, encryption and readiness.
- [Off-Grid Messaging](https://ungovernable.tech/kb/off-grid-messaging/): Messaging that survives when the internet does not: mesh radios, Bluetooth peer-to-peer, store-and-forward and human couriers compared.
- [Off-Grid Networks](https://ungovernable.tech/kb/off-grid-networks/): Communication networks that work without the public internet: LoRa meshes, Bluetooth meshes, overlay networks, packet radio and satellite links.
- [OnionShare](https://ungovernable.tech/kb/onionshare/): OnionShare shares and receives files, hosts static websites and runs chat rooms over Tor. Understand host trust, access keys and document risks.
- [OONI](https://ungovernable.tech/kb/ooni/): OONI Probe measures website, messaging and circumvention-tool reachability. Learn to read its public data and assess the risks of running tests.
- [OPAQUE and PAKEs](https://ungovernable.tech/kb/opaque-and-pake/): Password-authenticated key exchange and OPAQUE: logging in with a password without the server ever learning it, standardised by the IETF.
- [Open-Source TEEs](https://ungovernable.tech/kb/open-source-tees/): Open-source trusted execution environments such as Keystone on RISC-V and OP-TEE: alternatives to vendor TEEs, and how far they have come.
- [OpenWrt](https://ungovernable.tech/kb/openwrt/): OpenWrt replaces supported routers' firmware with a configurable Linux system. Check hardware, packages, upgrades, VPN and mesh uses, and trust.
- [Outline](https://ungovernable.tech/kb/outline/): Outline pairs a Shadowsocks server with a manager and shareable access keys. Understand self-hosting, operator visibility and blocking limits.
- [Overlay Naming: Tor .onion and I2P](https://ungovernable.tech/kb/onion-and-i2p-naming/): Tor .onion and I2P names are public keys, so no registrar can seize them: how overlay naming works, and its usability trade-offs.
- [Passkeys and Security Keys](https://ungovernable.tech/kb/passkeys-and-security-keys/): Passkeys bind sign-in to a service. Compare synced credentials and hardware security keys, their recovery paths, and the trust each requires.
- [Phala and 0G](https://ungovernable.tech/kb/phala-and-0g/): Phala and 0G, two TEE-first decentralized compute networks for confidential and AI workloads: architectures, attestation and track records.
- [PIR Implementations and Libraries](https://ungovernable.tech/kb/pir-implementations/): A tracker of private information retrieval implementations and libraries: single-server and multi-server schemes, performance and maturity.
- [PIR Research Frontier](https://ungovernable.tech/kb/pir-research-frontier/): The research frontier of private information retrieval: recent schemes, performance breakthroughs, open problems and what is close to deployment.
- [PIR Use Cases and Deployments](https://ungovernable.tech/kb/pir-use-cases/): Where private information retrieval is used, tested or planned: private contact discovery, password checks, certificate transparency and more.
- [PKARR: Public-Key Addressable Resource Records](https://ungovernable.tech/kb/pkarr/): PKARR turns an Ed25519 public key into a DNS zone: signed records are published to the BitTorrent Mainline DHT, with no registrar involved.
- [Pluggable transports and bridges](https://ungovernable.tech/kb/pluggable-transports/): Tor bridges provide alternative entry points; pluggable transports disguise the connection. Compare obfs4, Snowflake, meek and WebTunnel.
- [Polynomial Commitments](https://ungovernable.tech/kb/polynomial-commitments/): Polynomial commitment schemes such as KZG, FRI and IPA sit underneath every modern proof system. What they are and how they trade off.
- [Post-Quantum Cryptography](https://ungovernable.tech/kb/post-quantum-cryptography/): Replacing RSA and elliptic-curve cryptography with algorithms that survive quantum computers: the NIST standards, migration and harvest-now risk.
- [PQC Deployment and Libraries Tracker](https://ungovernable.tech/kb/pqc-deployment-tracker/): A tracker of where post-quantum cryptography is actually shipping: TLS, SSH, messaging, libraries, hardware and government migration deadlines.
- [Private computation compared](https://ungovernable.tech/kb/compare-private-computation/): Compare MPC, FHE, zero-knowledge proofs, TEEs and PIR by what they hide, who must be trusted, practical cost and implementation readiness.
- [Private Information Retrieval](https://ungovernable.tech/kb/private-information-retrieval/): Private information retrieval lets you fetch a record from a database without the server learning which record you asked for. How it works.
- [Private Information Retrieval: The Long Survey](https://ungovernable.tech/kb/pir-survey/): A long survey of private information retrieval: fetching a record from a database without the server learning which one, from theory to practice.
- [Private LLM Inference Patterns](https://ungovernable.tech/kb/private-llm-inference-patterns/): Concrete patterns for private LLM inference that combine TEEs, attestation, key management and transparency logs, each with an explicit threat model.
- [Private Set Intersection](https://ungovernable.tech/kb/private-set-intersection/): Private set intersection lets two parties learn which items they have in common and nothing else: protocols, performance and real deployments.
- [Proof of Personhood and Sybil Resistance](https://ungovernable.tech/kb/proof-of-personhood/): Proving one person, one account without a government ID: social graphs, biometrics, ceremonies and zero-knowledge approaches to Sybil resistance.
- [Psiphon](https://ungovernable.tech/kb/psiphon/): Psiphon tries multiple transports to reach its proxy network through censorship. Its open core, operator trust and privacy limits explained.
- [Pubky](https://ungovernable.tech/kb/pubky/): Pubky, an open protocol for key-based identity and data built on PKARR and the Mainline DHT: homeservers, the social app and its status.
- [Quiet](https://ungovernable.tech/kb/quiet/): Quiet synchronises team chat directly between members over Tor. Community owners control admission, and the unaudited software remains experimental.
- [Radicle](https://ungovernable.tech/kb/radicle/): Radicle replicates Git repositories, issues and patches between peers. Understand repository IDs, seed availability and forge federation.
- [Remote Attestation Architecture](https://ungovernable.tech/kb/remote-attestation/): Remote attestation lets you verify which code is running on which hardware before trusting it with secrets. The architecture, standards and pitfalls.
- [Remote Signing (NIP-46 and Friends)](https://ungovernable.tech/kb/remote-signing/): Remote signers and bunkers (NIP-46 and others) keep Nostr private keys on one device and sign for many apps, ending the habit of pasting keys.
- [Render Network](https://ungovernable.tech/kb/render-network/): Render Network, a decentralized GPU rental market that grew from 3D rendering into AI compute: how jobs, nodes and payments work.
- [Reticulum](https://ungovernable.tech/kb/reticulum/): Reticulum, a transport-agnostic, encrypted-by-default networking stack that runs over LoRa, packet radio, Wi-Fi and the internet at once.
- [RoboSats](https://ungovernable.tech/kb/robosats/): RoboSats trades bitcoin over Lightning and Tor using hold invoices and temporary identities. Understand coordinator custody, bonds and fiat privacy.
- [Satellite broadband and direct-to-cell](https://ungovernable.tech/kb/satellite-broadband/): Compare satellite terminals and direct-to-cell access through Starlink, OneWeb and Amazon Leo, including accounts, operator control and location limits.
- [Satellite IoT and Direct-to-Device Links](https://ungovernable.tech/kb/satellite-iot/): Narrowband data over satellite constellations and direct-to-phone links: short messages and telemetry from anywhere, and who controls them.
- [Secure Scuttlebutt](https://ungovernable.tech/kb/secure-scuttlebutt/): Secure Scuttlebutt replicates signed append-only feeds between peers. Understand gossip, public content, identity keys and the roles of pubs and rooms.
- [SecureDrop](https://ungovernable.tech/kb/securedrop/): SecureDrop lets newsrooms receive documents from anonymous sources over Tor. Its safety depends on dedicated servers, isolated viewing and careful use.
- [Semaphore](https://ungovernable.tech/kb/semaphore/): Semaphore lets a member of a group send a signal, such as a vote, proving membership in zero knowledge without revealing which member they are.
- [Session](https://ungovernable.tech/kb/session-messenger/): Session, a messenger that needs no phone number and routes messages over an onion network of nodes: how it works and its cryptographic trade-offs.
- [Sia and Storj](https://ungovernable.tech/kb/sia-and-storj/): Sia and Storj, two decentralized storage networks closest to ordinary cloud object storage: encryption, erasure coding, contracts and trust.
- [Silent Payments (BIP 352)](https://ungovernable.tech/kb/silent-payments/): Silent Payments give Bitcoin a reusable payment address without on-chain address reuse. BIP 352's privacy, scanning costs and confirmed wallet support.
- [SimplePIR and DoublePIR](https://ungovernable.tech/kb/simplepir-doublepir/): SimplePIR and DoublePIR, single-server private information retrieval schemes that run close to memory bandwidth: how they work and their costs.
- [SimpleX Chat](https://ungovernable.tech/kb/simplex/): SimpleX Chat, a messenger with no user identifiers at all: one-way message queues on relays you can choose or run, and what that hides.
- [Slashtags](https://ungovernable.tech/kb/slashtags/): Slashtags, Synonym's earlier protocol for key-rooted identity and peer-to-peer data sharing: what it attempted and why it was superseded by Pubky.
- [SLH-DSA (FIPS 205)](https://ungovernable.tech/kb/slh-dsa/): SLH-DSA (FIPS 205), the conservative hash-based post-quantum signature standard: large signatures, minimal assumptions, and when to use it.
- [SNARKs](https://ungovernable.tech/kb/snarks/): SNARKs are tiny zero-knowledge proofs that verify in milliseconds and can prove arbitrary computation: how they work, trusted setups and main systems.
- [Sovereign name lifecycle](https://ungovernable.tech/kb/sovereign-name-lifecycle/): Compare renewal, expiry and recovery for ENS, Handshake, Namecoin, Pkarr and onion services. Owning a key still leaves operational duties.
- [Sphinx Packet Format](https://ungovernable.tech/kb/sphinx-packet-format/): Sphinx, the compact, provably secure onion packet format used by modern mix networks and Lightning: how it hides route and position.
- [Stablecoins and sovereignty](https://ungovernable.tech/kb/stablecoins-and-sovereignty/): Holding stablecoin keys does not remove issuer control. Examine USDC and Tether freezing powers, redemption rules, chain choice and privacy.
- [STARKs](https://ungovernable.tech/kb/starks/): STARKs are transparent, hash-based proofs with no trusted setup and plausible post-quantum security: how they work and where they are used.
- [StartOS](https://ungovernable.tech/kb/startos/): StartOS manages a personal server through a browser. Understand service installation, backups, updates, optional Tor access and operator trust.
- [Stateful Hash-Based Signatures (XMSS, LMS)](https://ungovernable.tech/kb/stateful-hash-signatures/): XMSS and LMS, stateful hash-based signatures: small, conservative post-quantum signatures that are safe only if the signer never reuses state.
- [Swarm](https://ungovernable.tech/kb/swarm/): Swarm, Ethereum's content-addressed storage and messaging network with postage-stamp incentives and the Bee client: design and status.
- [Syncthing](https://ungovernable.tech/kb/syncthing/): Syncthing replicates files between devices you choose, with authenticated TLS, discovery and relays, plus an experimental encrypted storage mode.
- [Tahoe-LAFS](https://ungovernable.tech/kb/tahoe-lafs/): Tahoe-LAFS encrypts files before distributing erasure-coded shares across a storage grid, with capabilities controlling read and write access.
- [TEE Side-Channel Attacks](https://ungovernable.tech/kb/tee-side-channel-attacks/): A field guide to side-channel attacks on trusted execution environments, from cache timing to physical memory interposers, and the defences.
- [TEE state, recovery and revocation](https://ungovernable.tech/kb/tee-state-and-revocation/): Trusted execution needs state freshness as well as isolation. Examine sealing, rollback protection, TCB recovery and changing attestation policy.
- [TEE Technologies: SGX, TDX, SEV-SNP and Friends](https://ungovernable.tech/kb/tee-technologies/): Intel SGX and TDX, AMD SEV-SNP, Arm TrustZone and CCA, and other TEEs compared: isolation models, attestation and known weaknesses.
- [The Dihedral Coset Attack Line](https://ungovernable.tech/kb/dihedral-coset-attacks/): The dihedral coset problem and the line of quantum attacks on lattice cryptography it inspires: what has been claimed, refuted and still matters.
- [The OpenPGP Web of Trust](https://ungovernable.tech/kb/openpgp-web-of-trust/): The OpenPGP Web of Trust, the original decentralized trust model: key signing, trust levels, keyservers, and why it struggled at scale.
- [The Signal Protocol](https://ungovernable.tech/kb/signal-protocol/): The Signal Protocol, the reference for end-to-end encrypted messaging: X3DH and PQXDH key agreement, the double ratchet, and post-quantum upgrades.
- [Threshold Signatures](https://ungovernable.tech/kb/threshold-signatures/): Threshold signatures let any t of n parties sign while t-1 cannot: FROST, MuSig and threshold ECDSA, and their use in custody and protocols.
- [TLSNotary](https://ungovernable.tech/kb/tlsnotary/): TLSNotary proves selected data came from a TLS session. Learn MPC-TLS, selective disclosure, notary trust and the limits of website provenance.
- [Tor](https://ungovernable.tech/kb/tor/): Tor, the most widely used anonymity network: three-hop onion routing, onion services, bridges and pluggable transports, and what it does not protect.
- [Tornado Cash and Privacy Pools](https://ungovernable.tech/kb/tornado-and-privacy-pools/): Tornado Cash, Ethereum's zero-knowledge mixer, its sanctions and prosecutions, and Privacy Pools, the design that tries to separate illicit funds.
- [Tox](https://ungovernable.tech/kb/tox/): Tox offers encrypted peer-to-peer messaging without central accounts. Its public-key identities, exposed peer IPs and experimental core shape its limits.
- [Unstoppable Domains](https://ungovernable.tech/kb/unstoppable-domains/): Unstoppable Domains offers blockchain-based names: resolution choices, contract trust and what its deactivation patent does and does not establish.
- [Veilid](https://ungovernable.tech/kb/veilid/): Veilid is a peer-to-peer application framework with encrypted private routing. It supplies network building blocks, not a complete messenger trust model.
- [Verifiable Credentials](https://ungovernable.tech/kb/verifiable-credentials/): W3C Verifiable Credentials: signed claims in an issuer, holder and verifier model, with selective disclosure, and the privacy pitfalls of deployments.
- [Verifiable Delay Functions (VDFs)](https://ungovernable.tech/kb/verifiable-delay-functions/): Verifiable delay functions take a fixed amount of sequential time to compute but are quick to verify: constructions and uses in randomness beacons.
- [Verifiable Random Functions (VRFs)](https://ungovernable.tech/kb/verifiable-random-functions/): Verifiable random functions give pseudorandom outputs plus a proof the key holder computed them correctly, used in consensus and key transparency.
- [Web of Trust on Nostr](https://ungovernable.tech/kb/nostr-web-of-trust/): How Nostr uses the social graph to fight spam and rank content without central moderation: trust scores, NIPs, implementations and attacks.
- [Webs of Trust](https://ungovernable.tech/kb/web-of-trust/): Webs of trust establish reputation through social and cryptographic graphs instead of central authorities: models, uses on Nostr and PGP, and attacks.
- [Webs of Trust: The Long Survey](https://ungovernable.tech/kb/web-of-trust-survey/): A long survey of webs of trust: how decentralized systems decide which keys and people to trust, from PGP to Nostr, with algorithms and attacks.
- [White Noise](https://ungovernable.tech/kb/white-noise/): White Noise is an open-source messenger built on Marmot: MLS group encryption over Nostr relays, with no phone number, no email and no central server.
- [WireGuard](https://ungovernable.tech/kb/wireguard/): WireGuard encrypts IP traffic between peers with a small, fixed protocol. Its routing, operator trust and lack of built-in obfuscation explained.
- [XMPP with OMEMO](https://ungovernable.tech/kb/xmpp-omemo/): XMPP federates chat between independent servers; OMEMO encrypts messages between devices. Understand client choice, key verification and metadata limits.
- [Yggdrasil](https://ungovernable.tech/kb/yggdrasil/): Yggdrasil, an end-to-end encrypted IPv6 overlay mesh where every node's address is derived from its public key: how routing works and its alpha status.
- [YunoHost](https://ungovernable.tech/kb/yunohost/): YunoHost simplifies running a Debian server with packaged apps, users and backups. Learn what it manages and what the administrator still trusts.
- [Zcash](https://ungovernable.tech/kb/zcash/): Zcash supports transparent and shielded payments. Understand its privacy pools, Orchard's Halo 2 proofs, viewing keys and wallet limits.
- [Zero-Knowledge Privacy Applications](https://ungovernable.tech/kb/zk-privacy-applications/): Chains and protocols that use zero-knowledge proofs for shielded transactions, private smart contracts and shielded pools, compared by design.
- [Zero-Knowledge Proofs](https://ungovernable.tech/kb/zero-knowledge-proofs/): Zero-knowledge proofs let you prove a statement is true without revealing why: the concepts, proof systems and the privacy applications they enable.
- [ZK Email](https://ungovernable.tech/kb/zkemail/): ZK Email proves facts about emails, such as who sent them, by verifying DKIM signatures inside a zero-knowledge proof without revealing the email.
- [ZK Rollups](https://ungovernable.tech/kb/zk-rollups/): ZK rollups execute transactions off-chain and post a succinct validity proof on-chain: how they scale blockchains and where privacy fits in.
- [ZKML: Zero-Knowledge Machine Learning](https://ungovernable.tech/kb/zkml/): ZKML proves that a specific model produced a specific output without revealing the model or the input: techniques, costs and current limits.

## Also
- [Directory](https://ungovernable.tech/directory/): curated outbound links
- [Glossary](https://ungovernable.tech/glossary/): short definitions
- [Briefings](https://ungovernable.tech/briefings/): dated weekly research logs
- [Sources](https://ungovernable.tech/sources/): shared bibliography
- [Feed](https://ungovernable.tech/feed.xml)