title: Verifying signed git commits?
body: <p>With newer versions of <code>git</code> it's possible to sign individual commits (in addition to tags) with a PGP key:</p>
  
  <pre><code>git commit -m "some message" -S
  </code></pre>
  
  <p>And you can show these signatures in the output of <code>git log</code> with the <code>--show-signature</code> option:</p>
  
  <pre><code>$ git log --show-signature
  commit 93bd0a7529ef347f8dbca7efde43f7e99ab89515
  gpg: Signature made Fri 28 Jun 2013 02:28:41 PM EDT using RSA key ID AC1964A8
  gpg: Good signature from "Lars Kellogg-Stedman &lt;lars@seas.harvard.edu&gt;"
  Author: Lars Kellogg-Stedman &lt;lars@seas.harvard.edu&gt;
  Date:   Fri Jun 28 14:28:41 2013 -0400
  
      this is a test
  </code></pre>
  
  <p>But is there a way to programatically verify the signature on a given commit other than by grepping the output of <code>git log</code>? I'm looking for the commit equivalent of <code>git tag -v</code> -- something that will provide an exit code indicating whether or not there was a valid signature on a given commit.</p>