The commit signing docs mention that commits can be signed with GPG keys using GPG_PRIVATE_KEY and GPG_PASSPHRASE.
Could you also enable signing with SSH keys? GitHub allows for ssh keys Telling Git about your SSH key, and SSH signature verification is available in Git 2.34 or later.