$ git config --global user.signingkey=<yubikey-signing-sub-key-id>

$ git config commit.gpgsign true

$ git commit -m 'your commit message' --gpg-sign=6A886CD6

--OR--

$ git commit -S -m 'your commit message'

Show log:

$ git log --show-signature

1. https://help.github.com/articles/telling-git-about-your-gpg-key/
2. https://help.github.com/articles/signing-commits-using-gpg/
3. https://www.devroom.io/2014/06/04/gpg-sign-your-git-commits/
4. https://ocramius.github.io/blog/yubikey-for-ssh-gpg-git-and-local-login/