You can sign Git commits with an SSH key by setting gpg.format to ssh and pointing user.signingkey at your public key file. It needs Git 2.34 or later. It is a smaller setup than GPG and reuses a key you already protect.
The two commands
GitHub documents these:
git config --global gpg.format ssh
git config --global user.signingkey /PATH/TO/.SSH/KEY.PUB
Replace the path with your public key, the .pub file. You can use an existing SSH key or generate one just for signing.
To sign every commit and tag by default:
git config --global commit.gpgsign true
git config --global tag.gpgSign true
GitHub lists those in its GPG section, but they apply to any signing setup.
Check your Git version first
SSH signature support appears in Git 2.34. Run git --version. If it is older, update Git before you debug anything else.
What a signature does and does not prove
A signature shows that the commit was made by someone holding the private key. If the matching public key is registered with your Git host as a signing key, the host can mark the commit as verified.
It does not show that the code is correct, safe or reviewed. It also does not protect a stolen key. If an attacker has your key and your session, they can sign as you. That is why the passphrase and agent habits matter here too.
Should you use the same key for signing and login?
You can. GitHub says an existing key works. Many teams prefer a separate signing key so that revoking one purpose does not affect the other. The trade is more keys to track. For a small team, one key per device used for both is simple and acceptable. For a team with strict controls, separate signing keys are cleaner to audit.
Rolling it out to a team
- Confirm everyone has Git 2.34 or later.
- Have people add the public key to the Git host as a signing key. Check your host's documentation for the exact page.
- Turn on default signing in a shared setup script or onboarding doc.
- Decide whether branch protection should require signed commits. That is a policy decision, and it will block anyone whose setup is not working, so announce it first.
- Test with a throwaway repository before touching your main one.
Signed commits pair well with reviewing what lands on your laptop. See the checklist for opening an unfamiliar repo safely.
Quick check
Do signed commits mean the code is safe?
No. They show who held the key when the commit was made, not whether the change is good.
What if my Git is older than 2.34?
Update it. SSH signature verification is available from Git 2.34.
Sources
Last reviewed: 19 October 2026.
