The entire point of the signature is that it can't be forged. If a commit is signed with your private keys, I can reasonably conclude you authored it.

I know this is a solved problem in certain contexts, but realistically how does a third party prove that your private keys are yours?

Because if you're signing your commits you're probably also the type of person to sign your email with the same key.

Adding a data point to your statistics: I sign commits and packages I maintain (when it applies), not my emails.