Keybase.io is currently in public beta, but we'll go ahead and treat it as production ready, since it seems like an easy way to verify identities.
If you're a committer on metasploit-framework, and you need an invite, just ask.
|Github Username||Keybase.io Username|
Note, keybase.io does not require your private key to prove your GitHub identity. Actually sharing your private key with Keybase.io is a matter of contention -- here's the usual argument against, and here's one thoughtful argument for.
As all Metapsloit Framework committers are quite comfortable with the command line, there should be no need to store your (encrypted) private key with a third party. So, please don't, unless you have amazingly good reasons (and a great local password).
In order to get @todb-r7 to track your key, you alert him to its existence through some non-GitHub means, and verify your GitHub username. That's all there is to it.
It would be sociable to track him (and everyone else on this list) back. Tracking is essentially "trusting" and "verifying" -- see the much longer discussion here.
Signing merges and commits is easy and fun. Generate a signing key, if you
don't have one already, using your favorite PGP/GPG interface (I use
--gen-key). Then add this to your $HOME/.gitconfig:
[user] name = Your Name email = firstname.lastname@example.org signingkey = DEADBEEF # Must match name and email exactly! [alias] c = commit -S --edit m = merge -S --no-ff --edit
git c and
git m from now on will sign every commit with your
DEADBEEF key. However, note that rebasing or cherry-picking commits will
change the commit hash, and therefore, unsign the commit -- to resign the most
git c --amend.