

But why? Public is public. People can take my public key. The can encrypt my commit, making it indistinguishable from my commit.
Isn’t the idea to use your private key for encryption so that everyone can use your public key to decrypt your signature and to verify that it’s you who actually did the commit, because no one else has access to the private key?



Sorry for the confusion about “encryption”. I meant “signing” which is encrypting a hash of the commit with your private key, so that others can verify that your the author of the commit using your public key and the hash.
I think, the only confusion here was the original comment that referenced the public key for signing, but this was resolved, as it is just telling git which key pair to use. Probably, all people here understand the basics of asymmetrical encryption and signing and it was merely misunderstanding of how the command for signing git commits can be used.