Hi Tomas,
Thanks for raising this. You’re right that Studio-created commits were not explicitly cryptographically signed.
The name and email Studio requests during setup are Git author metadata. They identify the claimed author of a commit, but they do not prove who created it. Cryptographic signing is a separate mechanism involving a GPG, SSH, or X.509 signing key.
I’ve now added commit-signing support for the next Studio release. Studio will continue using its bundled Git client, so system Git is not required. Users can choose to sign both the initial commit and subsequent commits using their existing Git signing configuration.
Studio will not generate, import, or store private keys or passphrases. Git selects the configured signing key, including when the user has multiple keys. If signing is requested but the configured key or signing agent is unavailable, Studio will report the failure and will not silently create an unsigned commit.
Users without signing configured can continue committing normally; signing remains optional. Whether a hosting service displays a commit as “Verified” will also depend on that service recognising the associated public key.
