Public Key Recovery Options
You have limited options:
- You can recover your keys from a backup of your keyrings, if you have one.
- You can recover public keys from a keyserver, if you or someone else uploaded your key there.
- You can ask other people on your project for a copy of your public key, which they would have needed to verify your commits.
- You can see if GitHub has a backup containing your public key, and is willing to retrieve it for you.
That's about it. If you have lost your keys, include backups and copies, then you should treat them as lost for good. Pragmatically, from a Git perspective you can:
- Verify the Git history against a local or archived copy of the repository to ensure its authenticity, and then resign all your commits with a new key (if necessary, which it probably isn't).
- Sign the current commit once you've validated it against your sources, and then use the new key going forward.
Key material sufficient to recreate a public or private key can't usually be recovered just from signatures, so in future make sure you:
- Make regular backups.
- Escrow essential keys using a tool like paperkey or ssss, or some other recovery mechanism of your choice.
- Ensure your public key is uploaded to a reputable public keyserver and signed by others for validation.
- Store your public key under source control, perhaps even inside your source tree if appropriate for your project.
- Make sure you have revocation certificates on hand in case you lose your key.
Basically, take steps to ensure that your public key and revocation certificates are recoverable at need, and trusted by other keys besides the key itself.