When git signs a commit it pipes the entire commit, including the message at the end, and all headers to git. Then it goes back and adds the signature in a new gpgsig header.

I often see people getting this wrong in HN threads. Probably because that's how signed tags work.