# GPG keys

Open **Settings → GPG Keys** while signed in to add or remove a public signing key.

Keys are used for signature verification. Signed commits and annotated tags
show **Verified** or **Unverified** when the deployment provides verification
results. Unsigned objects and unavailable verification show no badge.

## View your keys

Each key shows its long key id, fingerprint, the first email from the key's
user ids, and the date it was added. Newest first.

## Add a key

**Add GPG key** opens a **Public key** field. Paste the armored block from
`gpg --armor --export <key id>`, starting with
`-----BEGIN PGP PUBLIC KEY BLOCK-----`, and press **Add key**. The key id,
fingerprint, subkey ids and emails are read from the key itself. Text that
is not a PGP key, or that is a private key, is refused. A fingerprint already
registered, on any account, is refused with "This GPG key is already
registered".

## Remove a key

The bin icon opens **Delete GPG key**; confirm with **Delete**.