GPG signing every commit has dubious benefits. You have to rebase your entire history if your GPG key is compromised. It also increases the footprint of the rep

GPG signing every commit has dubious benefits. You have to rebase your entire history if your GPG key is compromised. It also increases the footprint of the repo, and having signatures for more than HEAD is redundant (if the repo state is valid, then the DAG has been verified already). The best thing to do is to sign tags, IMO.