On: Signing Git commits with your SSH key (2021)

[exabrial]

Please just use pgp.

You need expiration, permissible purpose, revocation, identity, etc embedded into a ‘key’.

Pgp is really really good at doing these things and has been though the ringer on security. Yes pgp sucks at its original Purpose (encrypting email) but it’s excellent for signing things.

[waynecochran → exabrial]

Is there a particular implementation of PGP that folks should use?

[exabrial → waynecochran]

GPG is available nearly everywhere on every platform. If you're on OSX you can install MacGpg which provides a nice UI.