SSH signed commits stay "Unverified" even though SSH key and email are correctly registered

[Jorge-de-la-Flor]

Select Topic Area

Bug

Body

Hi, I’m seeing an issue with SSH signed commits not being marked as “Verified” on GitHub, even though the SSH key and email are correctly set up on my account.

Setup
I’m using WSL (Ubuntu) on my laptop and configured Git to sign commits with SSH:

git config --global user.name "FrostCore"
git config --global user.email "frostcore.dev@proton.me"
git config --global gpg.format ssh
git config --global user.signingkey /home/jorge/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

My SSH signing key on WSL:

ssh-keygen -y -f ~/.ssh/id_ed25519
# -> ssh-ed25519 AAAAC3N... frostcore.dev@proton.me

In GitHub → Settings → SSH and GPG keys → SSH keys I have:

• Title: WSL Ubuntu - LG gram laptop
• Type: Authentication key
• Fingerprint shown by GitHub:
  SSH · SHA256:pDF/BFyak9qh7EKmrGvzUSBP+/P1iGa8j6iNyjTmYBY · Added on Jan 29, 2026 · Never used — Read/write

If I edit that key in the UI, the stored public key is exactly the same line that ssh-keygen -y -f ~/.ssh/id_ed25519 prints (redacted here as ssh-ed25519 AAAAC3N... frostcore.dev@proton.me).

The email frostcore.dev@proton.me is verified on my account (Shows as “Verified” in Settings → Emails).

Example signed commit
In my repository Jorge-de-la-Flor/secret-vault-encryptor, I create a signed commit:

git commit --allow-empty -S -m "test: ssh verified"
git push

On my local machine:

git log -1 --show-signature

shows:

Good "git" signature for frostcore.dev@proton.me with ED25519 key SHA256:pDF/BFyak9qh7EKmrGvzUSBP+/P1iGa8j6iNyjTmYBY
Author: FrostCore <frostcore.dev@proton.me>
...

So Git verifies the signature, and the ED25519 key fingerprint SHA256:pDF/BFyak9qh7EKmrGvzUSBP+/P1iGa8j6iNyjTmYBY matches the fingerprint of the SSH key registered on my account.

Problem in the GitHub UI
On the commit page on github.com, the commit badge is still “Unverified”, and the tooltip says:

“Upload your public signing SSH key to verify your signature.”

This is confusing because:

• The public SSH key whose fingerprint is SHA256:pDF/BFyak9qh7EKmrGvzUSBP+/P1iGa8j6iNyjTmYBY is already registered as an SSH key on my account.
• The commit is authored as FrostCore frostcore.dev@proton.me, and this email is verified on my account.
• The repository is under my own user account (not a fork), and the commit is on the default branch.

From the docs for “About commit signature verification” and “Displaying verification statuses for all of your commits”, I would expect these SSH-signed commits to be marked as Verified – Signed with SSH, not Unverified.

Question
Is this expected behavior or a bug in how SSH-signed commits are being verified and displayed?

If helpful, I can provide:

• A specific commit URL where this happens.

• A screenshot of the SSH key entry in my settings (showing the fingerprint).

• A screenshot of the commit page showing the “Unverified” badge and tooltip.

Thanks in advance for looking into this.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[nathan-probert]

GitHub has separate authentication keys and signing keys, and it looks like you only have an authentication key set up right now. Go to Settings → SSH and GPG keys (the same page your key is already on) and add a new SSH key. In the dropdown, change Authentication key to Signing key. You can reuse the same public key if you want, and once it’s added, SSH-signed commits should immediately show as verified.

Note: If you use the same public key, all the old commits that are currently unverified should update to verified.

[ben-24-0]

your key is added on GitHub as an Authentication key
For SSH-signed commits to show as Verified, GitHub requires the public key to be added specifically as an SSH signing key

In the Github settings go to SSH and GPG keys
Click New SSH key
select Signing key type
and finally paste the same public key

[Jorge-de-la-Flor]

Thanks a lot, that solved it.

I added the same SSH public key as a Signing key in Settings → SSH and GPG keys and now all my SSH-signed commits show as Verified (including the old ones).

Really appreciate the help @nathan-probert @ben-24-0 !

[ben-24-0]

all cool 👍🏻