
15 min read
Securing Git Commits with GPG and YubiKeys: Best Practices for 2026
A practical, modern guide to signing your git commits with GPG and a YubiKey. Why it matters, where the common advice is overkill, and how to set it up properly.

A practical, modern guide to signing your git commits with GPG and a YubiKey. Why it matters, where the common advice is overkill, and how to set it up properly.

Since I worked as an architect in the compliant financial industry, I have been signing my git commits so that people cannot impersonate me in source code. I have always defaulted to a single GPG personal key that I could also use for both personal and work. But suddenly I needed to juggle two keys.