问题
I'm using git for most of my programming work and sign them with SSH key for most of the commits. However, when I updated git to version 2.17.1, git defaulted to signing with GPG key instead of the SSH key.
I would like to know what are the advantages and disadvantages of using a GPG key over a SSH key and why git is making GPG the default.
回答1:
SSH key is used for many authentication application such as logging in to ssh server, logging in, and many other applications.
This means that if you use it on a non secure environment and your private key is stolen, Others are able to fake your signatures and log on to all your computers.
GPG are widely used for singing emails files and other encryption activities. Therefore you can use it on a less secure environment since fake signing github is much less desirable than stealing your server.
来源：https://stackoverflow.com/questions/55953867/what-are-the-advantages-of-signing-git-commit-with-gpg-key-compared-to-ssh-key