There is a fantastic Thoughtbot article, written by Caleb, about signing commits (among other items, like emails). I presented it to our team as an excellent opportunity to provide some authenticity and ensure provenance.
If you don't have the time to follow along with Caleb, I'm going to attempt to tl;dr his article here. However, I highly recommend referring back to the original article.
Signing a commit proves you yourself made those changes. This is advantageous for a number of reasons that you can learn about from horror stories.
To get setup, run these commands:
brew install gpg2 gpg-agent pinentry-mac
gpg2 --gen-key
Use RSA and 4096. Set key expiry to 1 year if this is your first one. This way lost passphrases, forgotten keys, etc. all get expired. However, if you use PGP regularly, having a key that doesn't expire isn't unreasonable as long as you generate a revocation certificate you store somewhere separately, so pick 1 year.
After you follow the prompts, generate a revocation certificate, especially if not expiring your key.
gpg2 --output revoke.asc --gen-revoke your@email.com
Follow the prompts and tell gnupg you're giving no reason, since you're pre-generating it. Seriously, you need this. If you lose it, you're hosed, so store it safely. Printing as a QR code is highly recommended.
Finally, make this automatic for git by adding it to your gitconfig. This is the best part and was only recently added to git. Run gpg-agent so you only have to enter the secret key's passphrase once.
If you made it this far, consider exchanging and signing each other's keys at your organization for unlocking the full power.
