## TL;DR
Every commit in the PR needs a verified signature and at least one lacks it. Set up commit signing, register the public key with GitHub, then re-sign the PR's commits with a rebase and force-push. The unsigned commits are the whole problem; nothing else about the PR needs to change.

## The error
```text
merging is blocked: required signatures: how to fix unverified commits on the PR
```

## Steps

### 1. Check which commits are unsigned
```bash
git log --show-signature --oneline origin/main..HEAD
```
Expected output: commits show "No signature" or a bad-signature note. These are the ones to fix.

### 2. Create a signing key and add it to GitHub
Generate a GPG key (or use an SSH key for signing) and add the public key under GitHub Settings, SSH and GPG keys. GitHub must know the key or signatures show as unverified.
Expected output: the key appears in the GitHub settings list.

### 3. Enable signing locally
```bash
git config commit.gpgsign true
```
For SSH signing, also set the signing format and allowed-signers file per the git docs.
Expected output: new commits are signed automatically.

### 4. Re-sign the PR's commits
Replay the branch, signing each commit:
```bash
git rebase --exec 'git commit --amend --no-edit -S' origin/main
```
Expected output: the rebase rewrites every commit with a fresh signature.

### 5. Verify the signatures
```bash
git log --show-signature --oneline origin/main..HEAD
```
Expected output: every commit shows a good signature.

### 6. Push and merge
```bash
git push --force-with-lease
```
Expected output: the signature block clears and the PR becomes mergeable.

## When to use
- The exact "required signatures" merge block
- Commits show "Unverified" on the PR
- Setting up signing for the first time on a repo that requires it

## When not to use
- Linear-history or review-requirement blocks
- Signature verification failing for everyone (possible GitHub incident)
- Commits signed with an expired key (key management problem)

## Tool compatibility
- GitHub "Require signed commits" branch protection
- GPG and SSH commit signing (git 2.34 and later for SSH signing)
- gh CLI shows verification status on PR commits

## Variant phrasings
### commits must have verified signatures how to fix
Same fix. Sign, register the key, re-sign the branch.

### unverified commits blocking merge
The signature exists but GitHub does not trust the key. Step 2 is the fix.

### GPG signing setup for GitHub PRs
Steps 2 and 3 are the one-time setup. Steps 4 to 6 fix the current PR.

## Why it happens
Signed commits prove the author really made the commit. Branch protection can require that proof for every commit in the PR. Commits made before signing was configured, or signed with a key GitHub does not know, fail the requirement.

## Edge cases
- Vigilant mode: GitHub can sign web-UI commits itself. Web merges and suggestions may still need attention.
- Expired GPG keys: signatures from expired keys verify badly. Extend or rotate the key.
- Multiple machines: each machine needs the signing config, or commits from the unconfigured one stay unsigned.
- Re-signing rewrites SHAs, so open review comments anchored to old commits may detach. Warn reviewers.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6Ym5JC55oN7_cf7bxYasOA