Follow instructions here: https://gist.github.com/Beneboe/3183a8a9eb53439dbee07c90b344c77e
When you merge commits via GitHub UI (say "squash and merge"), GitHub will sign the commit itself.
Import GitHub webflow key so key is verified when you run git log --show-signature
Download from: https://github.com/web-flow.gpg
gpg --import web-flow.gpg