Alright, so I've been looking into this a bit more. I think this setting is kind of almost useless. Requiring signed commits is good, because if your account is compromised, if someone tries to push a commit in your name, they don't have your key, so it will be unsigned right? ...wrong (kinda). 1. They can create commits in the GitHub UI. Doing this, GitHub signs the commit with its own GPG key, so the commit is verified. 2. If they are able to create a personal access token (or even worse, if the only thing they compromise is your PAT and they don't even have to compromise your whole account), they can use the GraphQL endpoint to create commits, which are also automatically signed by GitHub's WebFlow GPG key. 3. There is no way at all in GitHub to enforce that commits are signed with YOUR key, only that they are signed with ANY key. sigh