GPG keys#

Open Settings → GPG Keys while signed in to add or remove a public signing key.

Keys are used for signature verification. Signed commits and annotated tags show Verified or Unverified when the deployment provides verification results. Unsigned objects and unavailable verification show no badge.

View your keys#

Each key shows its long key id, fingerprint, the first email from the key's user ids, and the date it was added. Newest first.

Add a key#

Add GPG key opens a Public key field. Paste the armored block from gpg --armor --export <key id>, starting with -----BEGIN PGP PUBLIC KEY BLOCK-----, and press Add key. The key id, fingerprint, subkey ids and emails are read from the key itself. Text that is not a PGP key, or that is a private key, is refused. A fingerprint already registered, on any account, is refused with "This GPG key is already registered".

Remove a key#

The bin icon opens Delete GPG key; confirm with Delete.