One thing to note here, is that key revocation is a normal and expected part of a keys life cycle. Maybe you roll your keys every two or five years? Some would

One thing to note here, is that key revocation is a normal and expected part of a keys life cycle. Maybe you roll your keys every two or five years? Some would argue that you should. When you retire an old key, it's not uncommon to revoke the old key. You could let it expire, but you could also publish a revocation cert for it, provide a reason, and maybe mention the new key. Another issue is that while signing commits can be good, it's not the primary basis for access control to the repository. If your key is compromised, what about the SSH key used to push to it? Things get fairly complex, when you run into situations like Alice signing her commits, later revoking her key because it got compromised, but then her collegue - Bob - force-pushes a branch, resets the repo entirely, or similar. Then Bob is pushing Alices commits, that were signed by a no longer valid key. I think a reasonably safe approach would be to say that: 1. Signed commits are viewed as trusted at the time they were first seen, providing the key is not revoked at that point. 2. Compromised keys may need to lead to an audit/damage control, at which point the signature is effectively degraded to a tool towards that end. If the key is revoked due to compromise, and the time of the compromise is unknown, you effectively can't depend on those signatures at all. So are signed commits worth anything at all then? I think so. Git is inherently a distributed thing, and I think signed commits can add verification that goes beyond the SSH-access to github or similar. People also potentially treat their ssh keys and code signing keys differently. Maybe they just reuse one set of ssh keys for everything, keeping it loaded in an ssh agent at all times, key-forwarding it all over the place, but unlock their gpg keys only when signing. In short: I think signed commits are useful despite possibly running into issues when keys are revoked, but I think it's important to consider what a valid signature provides at different times and in different circumstances. Sorry for the wall of text, just random things to consider.