Your Git Signing Key Shouldn't Live on Your Laptop

Eleven years ago I told everyone to use GPG to sign things. I still think signing is good. What I’ve soured on is where the key lives . Your commit signing key is sitting in ~/.ssh or a GPG keyring on the same laptop that runs npm install against the entire internet. The signature proves the commit came from your machine . It does not prove it came from you , and it definitely doesn’t prove the…