I think only tags should be signed, Torvalds has a good discussion about signing commits vs signing tags at http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-t...