Comment by petertodd

Shameless plug: you can mostly(1) solve the problem of Git PGP signatures becoming unverifiable due to key compromise with my OpenTimestamps software: https://petertodd.org/2016/opentimestamps-git-integration

tl;dr: it proves data existed in the past. In the case of a PGP signature on a Git commit, that can prove the signature (and the repo contents) were created prior to the key being compromised.

1) Mostly, because sometimes you don't know when the key was compromised.