Git commits can be signed with ssh keys.

Unfortunately I've found that not every source management tool understands SSH signatures and using them may have your commits end up being shown as signed by an untrusted key.

On Linux, GPG supports TPM2, but I'm not sure if that also works on macOS.

Some Fido2 keys like the YubiKey and Nitrokeys support PGP keys as well. Works pretty nice as well and has the added bonus of your key not being tied to a pice of hardware that is as likely to break like a laptop (or be upgraded on a semi-regular basis)

You can (mis)use ssh keys for git signing, but GPG on gpg-card and S/MIME on PIV card are the two standards and their respective hardware implementations (for signing keys in general.)

See my comment above regarding Keeta Agent, which supports GPG and SSH with the same key.