GitHub has supported GPG-signed commits since 2016: https://github.blog/2016-04-05-gpg-signature-verification/ https://github.blog/2016-04-05-gpg-signature-veri

GitHub has supported GPG-signed commits since 2016: https://github.blog/2016-04-05-gpg-signature-verification/ https://github.blog/2016-04-05-gpg-signature-verification/ AFAICT, the new thing here is that you can use SSH instead of GPG to sign commits, which should hopefully make it easier for people to adopt.