But isn't signing commits basically relying on SHA-1 values of tree and parent (this is what is signed ultimately [0])? That'd be the weakest link of the system

But isn't signing commits basically relying on SHA-1 values of tree and parent (this is what is signed ultimately [0])? That'd be the weakest link of the system. [0]: https://news.ycombinator.com/item?id=10353456 https://news.ycombinator.com/item?id=10353456