new gpg supports them for signing… do you not sign commits?