So this is a Github feature, which might be useful in some cases, I get that. The good news here is that it only goes one level deep, i.e., it does not automagi

So this is a Github feature, which might be useful in some cases, I get that. The good news here is that it only goes one level deep, i.e., it does not automagically show up on Linus' account in any way. This also has been an issue with Git for a long time. In any repository, you can see the email of the person who committed it, and it can be spoofed, because there are no checks. So while here we see it linked to Linus' account, the problem with plausible identity theft has always been a part of Git. There are ways to solve it. Git can just put "<unsigned>" next to non PGP commits. Github can also put "<unverified>" when commits are made outside of Github realm (not using their keys of https auth), or are unsigned. Just be careful while merging pull requests, which one has to anyway. And because one has to, these issues never seem to get a fix.