Why stop there? Most projects probably don't sign every commit, and even if they do, you'd still want to code review just to make sure mistakes or planted routi

Why stop there? Most projects probably don't sign every commit, and even if they do, you'd still want to code review just to make sure mistakes or planted routines didn't make it in. I'm assuming, of course, that any code you compile, you'd eventually want to /run/ somewhere. And if you're going to sandbox it or use permissions to restrict it, well, you could always do the same with the curl command. ;-)