However, it can be easily confusing and in 2012 (4 years after GitHub launched, as reference), Git got support for signing commits with a verifiable GPG key so you could run git log --show-signature and it would try to verify signatures with your local GPG toolchain. Now when you run git commit -S it will add a signature to your commit and if you upload the key you specify on the user.signingKey config value to GitHub or GitLab as a signing key (something you could only do starting about a year ago on GitHub and a little more recently on GitLab), they will see commits with the signature header and will try to verify it using signing keys on the account associated with the committer email address in the commit.