Based on this blogpost.
To sign Git commits, you need a gpg key. GPG stands for GNU Privacy Guard and is the de facto implementation of the OpenPGP message format. PGP stands for βPretty Good Privacyβ and is a standard to sign and encrypt messages.
Install with Homebrew:
$ brew install gpg