[chrisseaton]

Says it signs the commit with its own key. I guess you have to trust GitHub.

[Felk]

Well, yes. The question was whether you can sign _on GitHub_, so your private key has to be available to GitHub. You can always sign locally if you don't trust GitHub.

[drexlspivey]

What else would they be signing with? They don’t have your key obviously

[chrisseaton]

Well that was my point - I wonder why we haven't set up a system that lets me sign the merge commit. Otherwise it's a commit purported to be authored by me but when you look it's actually signed by someone else.