signing git commits

See gpg-agent forwarding

git config --global user.signingkey XXXXXXXXXXXXX

Enable signing of each commit by default:

git config --global commit.gpgsign true

git verify commit <HASH>
 
gpg:                using RSA key XXXXXXXXXX
gpg: Good signature from "User <user@example.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: XXXX XXXX ...

See raise trust level