If you've enforced branch protections in your repository, you can set up required commit signing. For more information, see "Configuring protected branches."
When you enable required commit signing on a branch, contibutors can only push commits that have been signed and verified to the branch. For more information, see "About commit signature verification."
You can always push local commits to the branch if the commits are signed and verified. However, you cannot merge pull requests into the branch on GitHub Enterprise. You can merge pull requests locally. For more information, see "Checking out pull requests locally."
Note: Enabling required commit signing on a branch will make it more difficult to contribute. If a collaborator pushes an unsigned commit to a branch that has required commit signing enabled, they will need to rebase their commit to include a verified signature and force push the rewritten commit to the branch.
Administrators of a repository can push local commits that have not been signed and verified, however you can require administrators to be subject to required commit signing. For more information, see "Enabling required commit signing."

Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
