Maybe quote the second line as well? > Would that not be a case where git relies on SHA1 for security? Someone could replace a tag or commit with a malicious v

Maybe quote the second line as well? > Would that not be a case where git relies on SHA1 for security? Someone could replace a tag or commit with a malicious version that verifies fine since it has the same hash the original developer signed. What's your response to this? To me it seems like this would be a serious issue.