Publishing a rotated GPG signing subkey to GitHub through the API

Tue, 29 Sep 2026 00:00:00 +0000

Summary

In this article we will explore how we can make it easier to rotate keys we use for signing commits, using the GitHub API.

Signing works without GitHub: the signature is in the commit or tag, and anyone with the public key can check it locally with git tag --verify or git log --show-signature.
Without the key on the account, GitHub shows signed commits as “Unverified”: “The commit is signed but the signature could not be verified.”¹
A branch that requires signed commits rejects them: “contributors and bots can only push commits that have been signed and verified to the branch”.²
An uploaded key is published in 1 fixed place tied to the account, readable without logging in: /users/<username>/ssh_signing_keys or /users/<username>/gpg_keys (see the next section).
Unsigned commits show no status, unless vigilant mode is on, which marks them “Unverified” too.³

Anyone can list an account’s public SSH signing keys without logging in:⁴
```
curl --silent https://api.github.com/users/<username>/ssh_signing_keys
```

The same for GPG keys:⁵

curl --silent https://api.github.com/users/<username>/gpg_keys

The GPG keys in armored form, ready for gpg --import:
```
curl --silent https://github.com/<username>.gpg
```