Thanks, I forgot that git got that wrong :&#x2F;<p>Edit: Actually, looking at the code (do_sign_commit), git appears to gpg sign the whole commit object.<p>I think it&#x27;s in signed tags where git only signs the sha1 being tagged.