rename gpg-key to pgp-key, for PGP is the correct name
author: link to full PGP key, sign commit

`git log --show-signature` can be used to verify the current contents of
the repository and all commits leading up to it.