Easy way to setup commits signing using SSH keys, if you’re interested (and somewhat good for security) 🙂. GitHub has supported SSH commit verification since 2022, so this has been a first-class option for years. Use the right SSH key below:
git config --global gpg.format ssh
git config --global user.signingkey $HOME/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true
mkdir -p ~/.config/git
touch ~/.config/git/allowed_signers
git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers
# Add own key to allowed signers (idempotent — grep first)
LINE="$(git config --global --get user.email) $(cat ~/.ssh/id_ed25519.pub)"
grep -qxF "$LINE" ~/.config/git/allowed_signers || printf '%s\n' "$LINE" >> ~/.config/git/allowed_signers
echo "--- ~/.config/git/allowed_signers ---"
cat ~/.config/git/allowed_signers
echo "--- resulting git config ---"
git config --global --get-regexp '^(commit\.gpgsign|tag\.gpgsign|gpg\.format|gpg\.ssh\.allowedsignersfile|user\.signingkey)$'
Then, register the signing key on GitHub (one-off, ~30 seconds):
pbcopy < ~/.ssh/id_ed25519.pub # Again use the right key here
Then head to github.com/settings/ssh/new (GitHub → Settings → SSH and GPG keys → New SSH key) → Key type: Signing Key (not Authentication) → paste. Give it a name like “MacBook — signing”.
The same public key material is already there as an Authentication key (that’s what git push uses); GitHub treats Auth and Signing as two independent slots for the same key blob, so you have to add it separately even though the bytes are identical.
Until you do that step, GitHub will show your commits as unsigned (no “Verified” badge). The signatures are still valid — GitHub just doesn’t know to trust the key yet.