Welp, there go my Git signatures
Signing new commit with new subkey on top of all others is a valid strategy to deal with this problem. Another would be creating new tag and signing it with the new subkey.<p>For me it&#x27;s not a problem that old commits are signed with revoked keys, there are several ways one can get old broken signatures (e.g. key rotation) and by design they should not be trusted.<p>One interesting voice in signing all commits by Linus:<p>&gt; Signing
each commit is totally stupid. It just means that you automate it, and you make the signature worth less. It also doesn&#x27;t add any real value, since the way the git DAG-chain of SHA1&#x27;s work, you only ever need _one_ signature to make all the commits reachable from that one be effectively covered by that one. So signing each commit is simply missing the point.<p>Source: <a href="http:&#x2F;&#x2F;git.661346.n2.nabble.com&#x2F;GPG-signing-for-git-commit-td2582986.html" rel="nofollow">http:&#x2F;&#x2F;git.661346.n2.nabble.com&#x2F;GPG-signing-for-git-commit-t...</a><p>Also, depending one one&#x27;s threat model signing all commits can still be not sufficient: <a href="https:&#x2F;&#x2F;github.com&#x2F;git&#x2F;git&#x2F;commit&#x2F;a85b377d0419a9dfaca8af2320cc33b051cbed04" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;git&#x2F;git&#x2F;commit&#x2F;a85b377d0419a9dfaca8af2320...</a>