GPG Signing AI Skill Guide

Overview & Engine Architecture

GNU Privacy Guard (GPG) provides OpenPGP keys for signing and encryption. In engineering workflows, the common use is signing git commits and tags so remotes can verify author authenticity. Agents help generate keys safely, configure git, export public keys to GitHub/GitLab, and never paste private key material into chat logs or tickets.

Private key (local / hardware token)
   -> gpg signs commit/tag payload
       -> Public key on Git forge
           -> UI shows Verified

When to use this skill

• Enabling verified commits for a team
• Signing release tags
• Verifying a downloaded artifact signature
• Rotating or revoking a compromised signing key