Edit: Turns out this still uses gpg? I think?
Anytime you use that public key (for example, to SSH into a server) that session is linked to your identity via git commits (this doesn't actually matter for github, as github exposes all your SSH keys via its API anyways).
However, the OpenSSH team were very careful to design their signature feature so that what is signed is always different from any possible SSH login.
Now, of course if you sign a text document which says "I want Bill to have all my stuff" but you meant, you know, Bill at work, can keep my stapler and that cool glow-in-the-dark mug, because I'm leaving next week and I can't be bothered to box it all up and take it, whereas your 2nd cousin William tries to persuade a judge it's a legal Will, and so your untimely death in a car crash should result in him inheriting everything instead of your bereaved wife and six year old daughter - well, that OpenSSH can't do anything about.
But you would be correct to assume it is not safe in general to use keys for unrelated purposes, and only the (documented and justified) choice by OpenSSH reverses that assumption for the SSH tools.
Nope, it uses your SSH agent. It's super confusing because the git config key is `gpg.format` (which you set to `ssh`), but I promise it works without GPG installed.
I suspect this confusing name is because when support for signing commits was originally added to git it only supported GPG, and a bad choice on the parameter name was made.