> > It also doesn't add any real value, since the way the git DAG-chain of SHA1's work, you only ever need _one_ signature to make all the commits reachable fro

> > It also doesn't add any real value, since the way the git DAG-chain of SHA1's work, you only ever need _one_ signature to make all the commits reachable from that one be effectively covered by that one. > He completely misses the point: who's going to check after pulling that the whole history of dozen/hundreds of commits is legit? That might be the case for the Linux kernel gatekeeper, but not for one of the several small contributors to any project. Git does that automatically for you. Git self-verifies the DAG (which is why it takes a while to warm up on the kernel repo because of the insane number of commits). So he's not missing the point.