## Background https://gitlab.com/gitlab-org/gitlab/-/issues/19185+ introduced signing to the commits created by Gitaly. While we believe having all commits signed is the right long term path for users, due to changes in the API and potential for external tooling it's too risky to enable for all users by default. In order to allow flexibility in rollout we should introduce group and project level options to enable customers to opt in to this new behavior. ## Proposal 1. Introduce a group level option to enable web-based commit signing. This setting should cascade down to all projects and sub-groups from the top level group. 2. Introduce a project level option to enable web-based commit signing. This setting should ONLY be available if the group level setting is NOT enabled. 1. This should use the [cascading settings](https://docs.gitlab.com/development/cascading_settings/) framework These new settings should be available via the Group and Project APIs. By introducing settings in this manner, we'll restrict control of this behavior to the top level group which allows organizations to enforce it across the board. However, by adding the flexibility of the project setting, we'll allow customers to be able to "test" the changes prior to a broad rollout. ### Additional Details 1. These settings should be `TRUE` for new groups on GitLab.com created after this is enabled. 2. We can consider making this `TRUE` for new projects in groups that have not enabled this at a later date We should consider if these settings should also be extended to the instance or if they should be available on self-managed. Currently self-managed opts an entire instance into this feature by setting up the configuration.