If I change my GPG key on GitHub, will my previous commits appear as not verified?

Question

Let's say I do the following:

1. Create new GPG signing key
2. Add it to GitHub
3. Delete the old key from GitHub

Will my previous commits still appear as verified?

Willy

Answer 1

Commits are displayed as "Unverified", if you delete the associated key from your GitHub user profile. See the GitHub docs here.

When you delete a key, GitHub displays a conformation dialog that includes the warning:

This action cannot be undone. This will permanently delete the GPG key. and if you'd like to use it in the future, you will need to upload it again.

Any commits you signed with this key will become unverified after removing it.

After deleting a key, associated commits are displayed as "Unverified". Clicking on the Unverified button will display instructions to upload the public signing key, along with the key ID.

Gumbo

Answer 2

Once you delete your key, old commits will be marked as 'not verified'

Intake

Answer 3

They changed this in 2021.

If your GPG key is expired or revoked for a reason other than being compromised, GitHub will continue showing commits that were previously signed with that key as “Verified”.

If you delete your old GPG key from your GitHub user profile, your old commits will still be shown as “Verified” as long as the key was not compromised.

Cb

As of February 2024, commits are displayed as "Unverified", if you delete the associated key from your GitHub user profile. See my answer. – Gumbo