Hacker News Reader

I know this is a solved problem in certain contexts, but realistically how does a third party prove that your private keys are yours?

Because if you're signing your commits you're probably also the type of person to sign your email with the same key.

Adding a data point to your statistics: I sign commits and packages I maintain (when it applies), not my emails.