I confirm that this --show-signature option (initially introduced in commit 0c37f1f, Oct 2011, Git v1.7.9-rc0) has no config setting or environment variable.
As illustrated by commit f2fef7b, that option is part of the "pretty options" Documentation/pretty-options.txt, which are supported by:
Update July 2016 (8 months later), with Git 2.10 (Q3 2016): "git log" learns log.showSignature configuration variable, and a command line option "--no-show-signature" to countermand it.
See commit fce04c3, commit aa37999 (22 Jun 2016), commit aa37999 (22 Jun 2016), and commit aefc81a (24 Jun 2016) by Mehul Jain (mehul2029).
(Merged by Junio C Hamano -- gitster -- in commit 369dc40, 11 Jul 2016) 
log: add log.showSignature configuration variable
Users may want to always use "--show-signature" while using git-log and
  related commands.
When log.showSignature is set to true, git-log and related commands will behave as if "--show-signature" was given to them.
Note that this config variable is meant to affect git-log, git-show,
  git-whatchanged and git-reflog.
  Other commands like git-format-patch, git-rev-list are not to be affected by this config variable.  
Update May 2017 (11 more months later)
The git config man page is now clearer:
log.showSignature
If true, makes git-log, git-show, and git-whatchanged assume --show-signature.