diff --git a/lib/gitlab/git/commit.rb b/lib/gitlab/git/commit.rb
index c85dcfa0475d499ef40d60e573a5961b6d8e10b8..8900e2d7afe780e908c811bb7e3414b3f2845774 100644
--- a/lib/gitlab/git/commit.rb
+++ b/lib/gitlab/git/commit.rb
@@ -213,11 +213,17 @@ module Gitlab
         end
 
         def shas_with_signatures(repository, shas)
-          shas.select do |sha|
-            begin
-              Rugged::Commit.extract_signature(repository.rugged, sha)
-            rescue Rugged::OdbError
-              false
+          GitalyClient.migrate(:filter_shas_with_signatures) do |is_enabled|
+            if is_enabled
+              Gitlab::GitalyClient::CommitService.new(repository).filter_shas_with_signatures(shas)
+            else
+              shas.select do |sha|
+                begin
+                  Rugged::Commit.extract_signature(repository.rugged, sha)
+                rescue Rugged::OdbError
+                  false
+                end
+              end
             end
           end
         end
diff --git a/lib/gitlab/gitaly_client/commit_service.rb b/lib/gitlab/gitaly_client/commit_service.rb
index 34807d280e53435cb244709c715bebb3227bd99f..7985f5b5457b48aca42baca87f4fd55ba6b3af87 100644
--- a/lib/gitlab/gitaly_client/commit_service.rb
+++ b/lib/gitlab/gitaly_client/commit_service.rb
@@ -250,6 +250,26 @@ module Gitlab
         consume_commits_response(response)
       end
 
+      def filter_shas_with_signatures(shas)
+        request = Gitaly::FilterShasWithSignaturesRequest.new(repository: @gitaly_repo)
+
+        enum = Enumerator.new do |y|
+          shas.each_slice(20) do |revs|
+            request.shas = GitalyClient.encode_repeated(revs)
+
+            y.yield request
+
+            request = Gitaly::FilterShasWithSignaturesRequest.new
+          end
+        end
+
+        response = GitalyClient.call(@repository.storage, :commit_service, :filter_shas_with_signatures, enum)
+
+        response.flat_map do |msg|
+          msg.shas.map { |sha| EncodingHelper.encode!(sha) }
+        end
+      end
+
       private
 
       def call_commit_diff(request_params, options = {})
diff --git a/spec/lib/gitlab/git/commit_spec.rb b/spec/lib/gitlab/git/commit_spec.rb
index 9f4e3c49adcbef7bdecf0154b9f6493f5d60e9c8..5ed639543e00349705a5f2798399847bbf71994b 100644
--- a/spec/lib/gitlab/git/commit_spec.rb
+++ b/spec/lib/gitlab/git/commit_spec.rb
@@ -278,6 +278,35 @@ describe Gitlab::Git::Commit, seed_helper: true do
       it { is_expected.not_to include(SeedRepo::FirstCommit::ID) }
     end
 
+    shared_examples '.shas_with_signatures' do
+      let(:signed_shas) { %w[5937ac0a7beb003549fc5fd26fc247adbce4a52e 570e7b2abdd848b95f2f578043fc23bd6f6fd24d] }
+      let(:unsigned_shas) { %w[19e2e9b4ef76b422ce1154af39a91323ccc57434 c642fe9b8b9f28f9225d7ea953fe14e74748d53b] }
+      let(:first_signed_shas) { %w[5937ac0a7beb003549fc5fd26fc247adbce4a52e c642fe9b8b9f28f9225d7ea953fe14e74748d53b] }
+
+      it 'has 2 signed shas' do
+        ret = described_class.shas_with_signatures(repository, signed_shas)
+        expect(ret).to eq(signed_shas)
+      end
+
+      it 'has 0 signed shas' do
+        ret = described_class.shas_with_signatures(repository, unsigned_shas)
+        expect(ret).to eq([])
+      end
+
+      it 'has 1 signed sha' do
+        ret = described_class.shas_with_signatures(repository, first_signed_shas)
+        expect(ret).to contain_exactly(first_signed_shas.first)
+      end
+    end
+
+    describe '.shas_with_signatures with gitaly on' do
+      it_should_behave_like '.shas_with_signatures'
+    end
+
+    describe '.shas_with_signatures with gitaly disabled', :disable_gitaly do
+      it_should_behave_like '.shas_with_signatures'
+    end
+
     describe '.find_all' do
       shared_examples 'finding all commits' do
         it 'should return a return a collection of commits' do