What is "this"? - If "sign with SSH instead of GPG", the answer is convenience. - If "sign commits", the answer is authentication of the user of the commit.

What is "this"? - If "sign with SSH instead of GPG", the answer is convenience. - If "sign commits", the answer is authentication of the user of the commit. Encryption part isn't relevant as you get that already regardless with https/ssh protocols when communicating with the git server. As for why you want to authenticate the user, the better question to ask, is, why wouldn't you? No one can push any commit on your behalf. In some cases it is extremely important because certain branches might be protected due to automated CI/CD pipelines that contain secrets. Without enforcing verification of authenticity, a user might push a commit pretending to be a different user, which exposes those secrets. One might say "well, then you have a bigger problem in your organization", which leads to the restated question of "why not?". It just one of those things we do, like health care workers washing their hands.