I completely agree. I was thinking it'd be nice if you could set a signing policy on GitHub - either all commits are signed or none are. A mixed situation jus

I completely agree. I was thinking it'd be nice if you could set a signing policy on GitHub - either all commits are signed or none are. A mixed situation just leads to harmful confusion. You would still need to verify sigs yourself, but if they're available for every commit this does still save you time before creating the signed tag.