How to fix error: gpg failed to sign the data: gpg: signing failed: Unusable secret key (key revoked) in Git

GitINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 126 views

This Git error occurs when attempting to create a signed commit or tag using a GPG key that has been revoked. The revoked key is no longer valid for signing operations. You need to either generate a new key or use a different existing key for Git commit signing.

Quick fix

Fixes error: gpg failed to sign the data: gpg: signing failed: Unusable secret key (key revoked)

git config --global user.signingkey
  1. Verify which key is configured for Git signing
  2. Generate a new GPG key
  3. Configure Git to use the new key
  4. Add the new key to GitHub/GitLab
git — error
git config --global user.signingkey
error: gpg failed to sign the data: gpg: signing failed: Unusable secret key (key revoked)

What this error means

When you configure Git to sign commits or tags with GPG, Git invokes the GPG program to create cryptographic signatures. This error indicates that the GPG key you're using has been marked as revoked. A revoked key is one that the owner (or someone with the revocation certificate) has explicitly invalidated. This typically happens when: - The private key was compromised or suspected of compromise - The key owner no longer uses that email address - The key was lost and the owner has generated a new one - The key was created for testing purposes and is no longer needed Once a key is revoked, GPG refuses to use it for new signatures because doing so would defeat the purpose of revocation. The revocation is permanent and cannot be undone—this is by design to ensure security. Git checks for this condition when you attempt any signing operation, including `git commit -S`, `git tag -s`, or when you have `commit.gpgsign = true` in your Git configuration.

Typical symptoms

  • Git commits fail with 'gpg failed to sign the data' error
  • Creating signed tags fails with 'Unusable secret key' message
  • Error mentions 'key revoked' in the output
  • Commits succeed when signing is disabled (-n or --no-gpg-sign)
  • Running 'gpg --list-secret-keys' shows the key with 'r' flag (revoked)
  • Previously working signing suddenly fails after importing a revocation certificate

Common causes

  1. The GPG key was intentionally revoked by importing a revocation certificate
  2. A key from a public keyserver was updated with a revocation notice
  3. The revoked key ID is still configured in Git (user.signingkey)
  4. GPG keyring contains multiple keys and the revoked one is being selected
  5. Key was revoked on another machine and the revocation synced via keyserver
  6. Subkey used for signing was revoked while the master key remains valid

How to fix "error: gpg failed to sign the data: gpg: signing failed: Unusable secret key (key revoked)"

1Verify which key is configured for Git signing

First, check which GPG key Git is configured to use:

bash
git config --global user.signingkey

Then verify the status of this key in your GPG keyring:

bash
gpg --list-secret-keys --keyid-format=long

Look for your key in the output. A revoked key will show [revoked] or have an r flag. The output might look like:

bash
sec   rsa4096/ABC123DEF456 2020-01-15 [SC] [revoked: 2024-06-01]
      ABCD1234EFGH5678IJKL9012MNOP3456QRST7890
uid           [revoked] Your Name <your@email.com>
2Generate a new GPG key

Since revoked keys cannot be used, create a new GPG key:

bash
gpg --full-generate-key

Follow the prompts:
1. Select key type: RSA and RSA (option 1) or ECC for modern systems
2. Key size: 4096 bits for RSA (recommended)
3. Expiration: Set an expiration date (1-2 years recommended)
4. Enter your name and email (must match your Git identity)
5. Set a strong passphrase

After generation, list your keys to get the new key ID:

bash
gpg --list-secret-keys --keyid-format=long

Note the key ID after sec rsa4096/ (e.g., ABC123DEF456789).

3Configure Git to use the new key

Update Git to use your new GPG key:

bash
git config --global user.signingkey YOUR_NEW_KEY_ID

Replace YOUR_NEW_KEY_ID with the key ID from the previous step.

If you haven't enabled commit signing, you can do so with:

bash
git config --global commit.gpgsign true

Verify the configuration:

bash
git config --global --get user.signingkey
4Add the new key to GitHub/GitLab

Export your new public key:

bash
gpg --armor --export YOUR_NEW_KEY_ID

Copy the entire output including the -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP PUBLIC KEY BLOCK----- lines.

For GitHub:
1. Go to Settings > SSH and GPG keys > New GPG key
2. Paste the key and click "Add GPG key"

For GitLab:
1. Go to User Settings > GPG Keys
2. Paste the key and click "Add key"

You may also want to remove the revoked key from these platforms to avoid confusion.

5Test the new signing configuration

Create a test signed commit to verify everything works:

bash
git commit --allow-empty -S -m "Test signed commit"

If successful, verify the signature:

bash
git log --show-signature -1

You should see output indicating a valid signature:

bash
gpg: Signature made Mon 01 Jan 2024 12:00:00 PM UTC
gpg: Good signature from "Your Name <your@email.com>"
6Alternative: Use a different existing key

If you have another valid (non-revoked) key you'd like to use instead:

bash
gpg --list-secret-keys --keyid-format=long

Find a key without the [revoked] status and configure Git to use it:

bash
git config --global user.signingkey EXISTING_VALID_KEY_ID

Make sure the email associated with this key matches your Git configuration:

bash
git config --global user.email
gpg --list-keys EXISTING_VALID_KEY_ID

The emails should match for verified commits on GitHub/GitLab.

Advanced notes

### Why Key Revocation is Permanent

GPG key revocation is designed to be irreversible for security reasons. Once a revocation certificate is imported, there's no way to "un-revoke" the key. This ensures that if a key is compromised and revoked, an attacker cannot simply remove the revocation.

If you accidentally revoked a key, your only options are:
- Generate a new key (recommended)
- If you still have the original key without the revocation, use that on a separate keyring (not recommended for production use)

### Handling Subkey Revocation

GPG keys can have subkeys for specific purposes (signing, encryption, authentication). If only a signing subkey was revoked but the master key is still valid, you can:

1. Create a new signing subkey:

bash
gpg --edit-key YOUR_KEY_ID
gpg> addkey

2. Select a signing-capable key type and follow the prompts

3. Save and exit:

bash
gpg> save

### Preventing Future Issues

Create a revocation certificate immediately after generating a new key:

bash
gpg --gen-revoke YOUR_KEY_ID > revocation-certificate.asc

Store this certificate securely offline. Only use it if your key is actually compromised.

Set key expiration:
Using expiring keys (1-2 years) is a good practice. You can extend expiration before it expires, but if you lose access, the key becomes unusable automatically.

### GPG Agent Issues

If you're getting caching issues after switching keys, restart the GPG agent:

bash
gpgconf --kill gpg-agent
gpg-agent --daemon

### Using SSH Signing Instead (Git 2.34+)

As an alternative to GPG, Git 2.34+ supports SSH key signing:

bash
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub

This can be simpler to manage than GPG keys for many workflows.

Frequently asked questions

What does "error: gpg failed to sign the data: gpg: signing failed: Unusable secr" mean?
When you configure Git to sign commits or tags with GPG, Git invokes the GPG program to create cryptographic signatures. This error indicates that the GPG key you're using has been marked as revoked. A revoked key is one that the owner (or someone with the revocation certificate) has explicitly invalidated.
How do I fix "error: gpg failed to sign the data: gpg: signing failed: Unusable secr"?
This Git error occurs when attempting to create a signed commit or tag using a GPG key that has been revoked. The revoked key is no longer valid for signing operations. You need to either generate a new key or use a different existing key for Git commit signing.
What causes "error: gpg failed to sign the data: gpg: signing failed: Unusable secr"?
The GPG key was intentionally revoked by importing a revocation certificate A key from a public keyserver was updated with a revocation notice The revoked key ID is still configured in Git (user.signingkey)
Is the "error: gpg failed to sign the data: gpg: signing failed: Unusable secr" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading