Git 2.34 (further improved with Git 2.35.1) makes possible to sign commits with SSH instead of GPG (or S/MIME). This make possible to use SSH instead of PGP/GPG (and the bad UX that comes with it) to do the work done by Tuleap Integrators. The workflow is easier since as long as you have a working SSH setup you have a working "Git commit signing" setup. The keys can also be easily stored on a hardware token like a YubiKey using either:

• the built in support of U2F token in SSH
• use PIV and something like yubikey-agent
• gpg-agent if you have an existing setup or if you hate yourself (yes I'm judging, it's my current setup after all)