What you need to know
A retained verification badge is evidence of the recorded signature check, not a fresh approval of the code.
Potentially affected
This concerns GitHub’s displayed signature-verification record. It does not establish that a change was reviewed, is free from defects, or remains authorized under the organization’s current key policy.
DSE recommendation
DSE recommends recording the commit identity and verification timestamp alongside the required review and release evidence.
A retained verification badge is evidence of the recorded signature check, not a fresh approval of the code.
Source facts
GitHub supports cryptographic verification of GPG, SSH and S/MIME commit signatures. Once verified, a persistent record remains within the repository network, including a verification timestamp. GitHub states that later key revocation, expiry or changes do not retroactively change that recorded status. Signing differs from a commit signoff, and vigilant mode adds its own displayed status distinctions.
Source: GitHub — About commit signature verification.
Applicability
This concerns GitHub’s displayed signature-verification record. It does not establish that a change was reviewed, is free from defects, or remains authorized under the organization’s current key policy.
DSE recommendation
DSE recommends recording the commit identity and verification timestamp alongside the required review and release evidence. Define how key revocation affects future acceptance without assuming historical badges will disappear. Keep signature policy, developer authorization and code review as separate controls. Train reviewers to recognize the relevant status and to investigate an unexpected author or signer rather than accepting a green badge alone. Write a policy example for a historically verified commit whose signing key is no longer approved for new work. Ask reviewers to distinguish the recorded signature result from present release authorization, and keep the current acceptance decision alongside the commit identifier.
Verification
Proposed verification: using authorized test commits, compare signing status, signer identity and the available verification timestamp. Exercise the repository’s intended acceptance checks in a test branch. Retain the observed metadata and current policy decision, and verify functional review evidence separately from the cryptographic origin check.
Official reference
GitHub — About commit signature verification. Reviewed October 20, 2026.
Review the official source
GitHub — About commit signature verification · Verified October 20, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE