We should explore setting up commit signing with GPG in Desktop. This could take two forms (or both):

1. Automatic commit signing using GitHub's GPG key in the same way that dotcom does it today, if the user is signed in to GitHub from Desktop.
2. Allow people to set up and utilize their own GPG key to sign commits in Desktop, and make that visible to users during the commit flow.