Set git config gpg.format ssh (or openpgp, x509), user.signingkey and commit.gpgsign true; verify with git log --show-signature or git verify-commit. SSH verification needs gpg.ssh.allowedSignersFile listing principals and keys. Git signs the commit object itself, which commits to the tree and parents but not to later rebases, which create new commits needing new signatures.
GitHub and GitLab show Verified badges when the signature matches a key registered to the committer's account (SSH signing keys are registered separately from authentication keys), and branch protection can require signed commits. gitsign signs commits keylessly with Sigstore. A signature proves which key signed, not that the code is good, and platforms re-sign web-UI merges with their own keys.