Would signed commits be a value add over CVS? You'd think the security conscious OpenBSD ecosystem would value a way to verify the integrity of the source tree

Would signed commits be a value add over CVS? You'd think the security conscious OpenBSD ecosystem would value a way to verify the integrity of the source tree for any given commit or tag or release. I have to admit I'm not an OpenBSD user so I have no idea if they have something similar for CVS these days?