The "verified" checkmark in GitHub UI is not really a big reassurance. Someone can steal your private key, continue to use it and still be verified until you or

The "verified" checkmark in GitHub UI is not really a big reassurance. Someone can steal your private key, continue to use it and still be verified until you or someone else notices and revokes the key. GitHub, for example, has their own GPG key as verified for commits you author on their UI. In this case, you're trusting GitHub –and GitHub can also mark sigstore certificates as verified as well (they should), as they're actually verifiable using a transparency log. What sigstore really brings to the picture is the attestation of "whoever signed this commit was actually signed into the github account @foo –or google account bar@google.com at the time, and here's the proof in a transparency log" –and those accounts can be secured by 2FA. It also takes you out of GPG key management business which I personally despise.