The following step-by-step guide will assist you to start pushing signed commits and create signed tags. This is a quick-start guide. For more details, you can visit here and here.
There some topics to take into account on why we decided to follow a specific approach on certificate management:
- GitHub does not handle master certificates revocation but the community seems to not care about this because the purpose of these certificates is to demostrate to others that you are you and not other person impersonating you. If your certificate expires or is stolen, you simply create a new one and upload it to GitHub. Because GitHub also verifies the email address, a thief must also gain to your account in order to be able to use it.
- Using subkeys is preferable but updating them and GitHub periodically can become a pa