And I believe these days you can use SSH keys for signing commits as well.
You can use SSH keys as well.
Just use an ssh key for authentication and there is no need to sign commits.
How does SSH authentication provide the same guarantees as signing commits?
ssh itself is cryptographically secure. the ciphertext of the commit being pushed is as good as a signature
I guess you are considering the case where a single signer transfers commits over SSH to a single verifier, with both putting the same meaning into the act of transfer as people normally would into a signature. But git is a distributed VCS, with signatures handling many more scenarios: consider multiple committers and multiple signatures, transfer over multiple, different, untrusted channels, multiple verifiers.