title: What exactly does "git show --show-signature" verify?
body: <p>After cloning a remote git repository and issuing <code>git show --show-signature</code>, it says the signature is good. Then I changed some files and tested the same command, and it still says the signature is good. </p>
  
  <p>What exactly does the above command check? What is the correct way to verify the cloned git is what is meant by the developer?</p>