GitHub has supported GPG-signed commits since 2016: https://github.blog/2016-04-05-gpg-signature-verification/

AFAICT, the new thing here is that you can use SSH instead of GPG to sign commits, which should hopefully make it easier for people to adopt.