Interesting - I have not thought about such scenarios earlier. I think that if you remove your key from GitHub, old commits should be left in place. The various

Interesting - I have not thought about such scenarios earlier. I think that if you remove your key from GitHub, old commits should be left in place. The various key servers on the Internet will acknowledge the revoked key, and no more new commits will be introduced with that key. However, there is a potential issue when an attacker will try to rewrite Git history and use your old key to sign malicious code.