The Developer Certificate of Origin mentions a signature:
I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off...
Does this mean a cryptographic (GPG) signature?
Typically all you need is a text signature, which you can achieve with:
git commit -s
However, the signing mechanism is not defined by the DCO, but by the project. Some projects may ask for a cryptographic signature, others may ask that you use your work-based email (if submitting from work), others may ask that you send an email, or some combination.
This is based a determination by the project balancing ease-of-use and legal risk. (Similarly to a CLA.)
The DCO uses a common law technique called agency by which a person can act on behalf of an entity like a corporation... using a corporate email as a developer is [an example of] such a sign of authority. (James Bottomley, A modest proposal on the DCO)
References:
Examples:
Signed-off-by metadata is only marginally more useful than the commit author. It is unlikely that this sign-off would be considered to be a legally binding signature, as it cannot be used to verify the identity of the signatory. It can also be faked easily, since it's not cryptographic. This metadata may be helpful for review workflows, but has minimal value as a reliable record of DCO acceptance.