Provenance for your commits

BetterSign™

Sign git commits, tags, and releases with BetterSign keys through a drop-in gpg replacement — and rotate your signing key without ever becoming a stranger to your own history.

Stable identity

A VLAD remains stable while its keys and protected metadata rotate.

Self-verifying history

Every state transition is hash-linked and authorized by the previous log state.

Decentralized discovery

VLADemlia helps peers locate current records without becoming the trust root.

Routine rotation

Key changes become signed updates that followers can verify and apply.

Provenance for your commits

Git & Code Signing

Why Sign Your Commits and Code

A signature on a commit or a release answers a question the rest of your toolchain cannot: who really made this, and has it changed since? Without it, a commit author is just a string anyone can type, and a downloaded binary is just bytes you hope are genuine.

Signing turns authorship into something anyone can verify. BetterSign brings its rotating-key identity to that job, so the answer stays trustworthy even as your keys change over the years.

A Drop-in Replacement for gpg

bs-gpg speaks the same command-line interface git already expects, so you point git at it once and nothing else in your workflow changes.

Your commits sign and verify exactly as before — the difference is what sits underneath: a BetterSign multikey and a provenance log instead of a static PGP keyring.

git config --global gpg.program bs-gpggit config --global commit.gpgsign truegit commit -S -m "signed with BetterSign"git verify-commit HEAD

Rotate Your Signing Key Without Becoming a Stranger

With ordinary GPG, rotating your signing key means a new key id and a scramble to re-establish trust: update every keyserver, re-collect signatures, and hope no one still trusts the old key. So people keep the same signing key for years.

With BetterSign, your identity is a VLAD that never changes. Rotating your signing key is a signed page in your logbook. New commits use the new key, old signatures still verify against the recorded history, and anyone verifying simply replays the log — no keyserver dance, no lost reputation. Watch key rotation in action.

Traditional GPG vs. BetterSign Git Signing

Traditional GPG
  • Rotating means a new key id and lost trust
  • Trust bootstrapped from keyservers and the web of trust
  • Revocation certificates that may never reach verifiers
  • One long-lived key, rarely rotated
BetterSign (bs-gpg)
  • Identity (VLAD) stays; the key rotates underneath
  • Trust proven by replaying a signed provenance log
  • Revocation is a signed entry the network converges on
  • Rotate freely — the whole history stays verifiable

Post-Quantum and Threshold Signing, Same Tool

Because bs-gpg signs with BetterSign multikeys, every algorithm BetterSign supports is available for git — including post-quantum schemes for signatures that must outlive the arrival of quantum computers.

For high-stakes releases, a signing key can be split so that several maintainers must jointly approve the signature, without any one of them ever holding the whole key.

Signing Options for Git

Any BetterSign algorithm, selected per identity — see the Cryptography page for specifics.

Classical
Ed25519, Ed448, ECDSA, RSA — small, fast, familiar
Post-quantum
ML-DSA, SLH-DSA, FN-DSA, MAYO — built to outlive quantum computers
Hash-based
XMSS and Lamport for conservative, hash-only security
Threshold
require several maintainers to jointly sign a release

How It Works

When you sign, bs-gpg produces a BetterSign multisig and wraps it in the PGP armor git expects, so git and other tools treat it as an ordinary signature. When you verify, it checks that signature against the signer identity resolved from the provenance log.

The result is a signature that fits every tool that already understands gpg, backed by trust that no longer depends on a keyserver being online or a static key never changing.

Sign and Verify Path

You run git commit -S, and git calls bs-gpg
bs-gpg signs with your BetterSign key, producing a multisig
The multisig is wrapped in PGP armor git understands
A verifier resolves your identity from the provenance log
The signature verifies against your current, recorded key

Commands

bs-gpg mirrors the gpg flags git and scripts rely on, so it slots into existing automation.

bs-gpg --gen-key # interactive key generation (any algorithm)bs-gpg --sign / --detach-sign # PGP-armored BetterSign signaturesbs-gpg --verify sig.asc # verify a signaturebs-gpg --list-keys # list stored keysbs-gpg --import / --export # PGP armor or multikey formatbs-gpg --status-fd 2 # machine-readable status for git
Interface Drop-in gpg replacement
Backing BetterSign multikey + provenance log
Algorithms Classical, post-quantum, hash-based, threshold