// step 01
Export your secret key from PGPony.
From the Keyring tab, tap your key to open its detail view. Tap
Export Private Key — PGPony walks through a two-step confirmation and
biometric re-auth, then writes the ASCII-armored .asc file. Transfer to your desktop via
AirDrop, USB, or another encrypted channel — same procedure as the
backup guide.
For dev-machine signing only, you don\'t need the primary secret key. If your PGP key has a
dedicated signing subkey, exporting just that subkey\'s secret material narrows the blast
radius. gpg --export-secret-subkeys is the desktop-side equivalent (after the
full secret key is imported).
// step 02
Import into desktop GnuPG.
gpg --import your-key.asc
gpg --list-secret-keys --keyid-format=long
The output shows your key with the full fingerprint. Copy it — you\'ll use it in the next
step. (The fingerprint is the 40-character string on the line below sec.)
// step 03
Configure git.
git config --global user.signingkey YOUR_FINGERPRINT_HERE
git config --global commit.gpgsign true
git config --global tag.gpgsign true
Now every commit and tag you create signs automatically.
Per-repo override
Drop --global from any of these to set per-repo instead. Useful if you maintain
multiple identities (work vs personal) and only want some repos signed with this key.
// step 04
Match git user.email to a key User ID.
Git\'s author email must match one of the email addresses bound to your PGP key for GitHub
(and similar) to validate the signature against the key:
git config --global user.email you@yourdomain.com
Mismatch shows "Unverified" on GitHub even if the signature math is valid.
// step 05
Make a test signed commit.
In any repo, make a small change and commit:
cd ~/your-repo
echo "test" >> README.md
git add README.md
git commit -m "test signed commit"
gpg prompts for your passphrase (or uses the cached one if pinentry is configured). Once
entered, git completes the commit with a PGP signature attached.
No pinentry prompt?
On macOS, install pinentry-mac. On Linux, ensure gnupg2 and pinentry-gtk2 or pinentry-curses
is installed and gpg-agent is running. Without pinentry, gpg can\'t prompt for the passphrase
and signing fails silently.
// step 06
Verify locally.
git log --show-signature -1
Look for:
gpg: Signature made [date]
gpg: using EDDSA key YOUR_FINGERPRINT
gpg: Good signature from "You <you@yourdomain.com>" [ultimate]
"Good signature" with no warnings confirms local signing works. Any failure messages here
point at config — usually the user.email mismatch or pinentry issue from earlier steps.
// step 07
Upload public key to GitHub.
Get your ASCII-armored public key for upload:
gpg --armor --export YOUR_FINGERPRINT
Copy the entire output from -----BEGIN PGP PUBLIC KEY BLOCK----- through
-----END PGP PUBLIC KEY BLOCK-----.
In GitHub, go to Settings → SSH and GPG keys → New GPG key. Paste the public
key block. GitHub validates and adds it. Future signed commits from matching email get the
Verified badge on the commit history.
GitLab: Preferences → GPG Keys. Bitbucket: Personal settings → GPG
keys. Same flow.
