: This usually refers to Commit Signature Verification , where GitHub confirms a commit was made by a specific user. It does not mean GitHub "vouched" for the safety or legality of the software.