
15 min read
Securing Git Commits with GPG and YubiKeys: Best Practices for 2026
A practical, modern guide to signing your git commits with GPG and a YubiKey. Why it matters, where the common advice is overkill, and how to set it up properly.

A practical, modern guide to signing your git commits with GPG and a YubiKey. Why it matters, where the common advice is overkill, and how to set it up properly.

Since I worked as an architect in the compliant financial industry, I have been signing my git commits so that people cannot impersonate me in source code. I have always defaulted to a single GPG personal key that I could also use for both personal and work. But suddenly I needed to juggle two keys.

Some software projects will use a monorepo for multiple components, especially projects migrating to the cloud. Let's create multiple Azure DevOps pipelines for a single git repository. But this is not without disadvantages.