Signing Git Commits with SSH Keys
Git identity is self-declared. user.email is a config value, not a credential — anyone can set it to your address, commit, and push wherever they have write access. GitHub renders your avatar on the result. Nothing in the process verifies that you wrote anything. Commit signing fixes that, and since Git 2.34 you can do it with the SSH key you already push with. No GPG keyring, no key servers, no expiry dance. ...