I don't have a general solution, but the following works well for signed commits at my workplace (disclaimer - all comments and thoughts my own): * IT, autho

I don't have a general solution, but the following works well for signed commits at my workplace (disclaimer - all comments and thoughts my own): * IT, authority of all secrets, owns the primary keys for all employees. * Each employee has a code signing subkey generated which is signed as trusted by an org-wide key. * The employee is given the private part of their code signing subkey. * The public parts of the org-wide key and employee code signing keys are made available to everyone via a keyserver. Now all commits can be forced to be signed, can be validated by checking that the org-wide key trusts the key, and be checked over time by using the keyserver. IT, being responsible for corporate security, manages the secret bits without involving engineering. Keys can be rotated on demand, when laptops are lost, and revoked when employees leave. It also resolves all the issues with each person managing their own primary key and dealing with the web of trust problems associated with that.