It's a nice feature to add signature verification to the UI, but it does leave out the trust aspect of PGP. Showing a green "verified" badge may be misinterpret

It's a nice feature to add signature verification to the UI, but it does leave out the trust aspect of PGP. Showing a green "verified" badge may be misinterpreted by users who are less familiar with PGP because they may think of it as meaning "you can trust the authenticity of this commit," which is not what it actually means. GitHub can verify that the signature matches the public key that the author uploaded to their account, but that's not actually useful unless the person viewing the commit trusts that public key. It would be great if it had three different badges to distinguish between different things: perhaps a red "unsigned" for commits with no signature at all and "invalid" for commits with a bad signature, a yellow "verified" for commits with signatures that match the author's uploaded public key, and a green "trusted" if the person viewing the commit has marked the author's public key as trusted.