Beware: Signing commits with SSH or GPG keys removes the "plausible deniability" [1][2].
Of course certain projects (especially if very critical or secure systems) definitely benefit from that but imagine you put your handwritten signature on every single step of your work (hint: you don't do that in the real World). You would never do so for normal internet activity like Google searches, Twitter or Facebook yet you want to sign your git commits with a signature undeniable connected to yourself, probably also connected to your real name.
If you just think that signing is just a "cool feature to have" then you should really educate yourself about implications of having a connected (real name?) identity on the internet.
P.S.: I just wanted to make people think before activating this feature. Most GitHub code and repositories worked perfectly without it. Do you really need it? When yes, why?
Of course certain projects (especially if very critical or secure systems) definitely benefit from that but imagine you put your handwritten signature on every single step of your work (hint: you don't do that in the real World). You would never do so for normal internet activity like Google searches, Twitter or Facebook yet you want to sign your git commits with a signature undeniable connected to yourself, probably also connected to your real name.
If you just think that signing is just a "cool feature to have" then you should really educate yourself about implications of having a connected (real name?) identity on the internet.
[1] https://en.wikipedia.org/wiki/Plausible_deniability
[2] https://legaldictionary.net/plausible-deniability/
P.S.: I just wanted to make people think before activating this feature. Most GitHub code and repositories worked perfectly without it. Do you really need it? When yes, why?