Re:GPG signature verification
by cyphar on Wednesday April 06, 2016 @01:10AM
(#11436749)
I'd argue that's a feature, especially with something as intractable as a commit history. If you sign a commit today, and the only place that stores your key is GitHub (where you can delete your key), I can't verify that signature forever.
I think a much better system is using keybase (with your GitHub identity linked to keybase), and then checking the gpg signatures using git locally. GitHub's setup has no tangible benefits (if you can log in to an account and therefore can push to your own repositories and make pull requests as yourself, you can also change the trusted GPG keys). The only case where it might help is to show that a commit on someone else's repo isn't you. But surely that's something people already assume?
I think a much better system is using keybase (with your GitHub identity linked to keybase), and then checking the gpg signatures using git locally. GitHub's setup has no tangible benefits (if you can log in to an account and therefore can push to your own repositories and make pull requests as yourself, you can also change the trusted GPG keys). The only case where it might help is to show that a commit on someone else's repo isn't you. But surely that's something people already assume?