Hacker News Reader

You'll need to re-upload your public SSH key as a signing key for the signatures to be shown as verified. https://calebhearth.com/sign-git-with-ssh#github

This was it, thanks for the pointer!

You need to re-add your SSH key and there's a new key type select box that has "signing" option. The old keys are only good for auth.

This was it, thanks for the pointer!

All my old commits show as verified now

My guess is that they may have forgotten to backfill old data (because probably whether a commit is verified is not computed on the fly), but I don't see why it can't apply retroactively.

Maybe try removing and adding the public key from your account? That might trigger the system to scan all your commits and re-verify.