I'm not sure I understand GPG, and something on GitHub has left me wondering.
In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key of the committer to verify the signature. If they know that the public key does indeed belong to the committer, then they can verify the commit authenticity.
By my understanding, the public key is public and it should be considered that anyone could have a copy of it.
In GitHub, it is possible to associate a public GPG key with an account by adding it through the settings, which will then display the commits as Verified, here's an example.
In addition, GitHub API exposes the GPG keys, here's an example.
There is something I am confused about though. Since all GPG public keys are supposed to be public, wouldn't it mean that anyone in possession of my public key could associate it with their account even if they are not in possession of the private key, and therefore the Verified status does not provide authenticity?