My original statement is slightly incorrect; you can. The commit hash is probably used as part of the signature. It would have been better to sign the commit bl

My original statement is slightly incorrect; you can. The commit hash is probably used as part of the signature. It would have been better to sign the commit blob directly, as Git stores the length alongside the hash from that point down in the DAG (making prefix attacks impossible).