The analogies used do not work but are strongly being used as a foundation for the rest of their arguments, so the entire reasoning feels weak and misguided. N

The analogies used do not work but are strongly being used as a foundation for the rest of their arguments, so the entire reasoning feels weak and misguided. No, we don't sign things with keys in real life, the same words being used in two different spheres of life do not make one 'false'. The HTTPS one is more of a rabbit hole of misunderstanding — trying to draw similarities with https and git signing is probably the root of the problem here. I'd suggest considering it on its own merit, and trying to understand why git commit signing was introduced, and what you would use it for given the cases. Also worth noting that some of the info is wrong, Github is not the root of trust, and also aren't the only one who encourage it; Gitlab have a similar guide and badge FWIW.