Sign your git checkin with GPG — Tested in macOS

List your current gpg keys:

gpg --list-keys
/Users/user/.gnupg/pubring.kbx
----------------------------------
pub   rsa2048 2019-10-21 [SC] [expires: 2021-10-20]
      C29AFE8BLB14FF1CCF14FF18F6211DF8C28BE2C2
uid           [ultimate] Arnab Karmakar <arnab.k@gmail.com>
sub   rsa2048 2019-10-21 [E] [expires: 2021-10-20]

If you do not have any GPG keys, generate one using the command below and following the instructions as displayed:

gpg --gen-key

Note down the key generated C29AFE8BLB14FF1CCF14FF18F6211DF8C28BE2C2

Put the following in gpg-agent.conf file (edit file with vi ~/.gnupg/gpg-agent.conf command):

pinentry-program /usr/local/bin/pinentry-mac

Put the following in gpg.conf file (edit file with vi ~/.gnupg/gpg.conf command):

no-tty

Kill all currently running gpg agent

killall gpg-agent

Run the following commands in your git project

git config user.signingkey C29AFE8BLB14FF1CCF14FF18F6211DF8C28BE2C2
# Do some changes in your project
git commit -a -S -m 'Testing git commit signing'

If you used Github, you can visit the commit history and confirm that it was signed

A new Unverified button will show up. If you click that, it will give you option to upload your public key to verify your signature