3 ms·
You could just GPG sign your commits, then you can know for sure where the commit is coming from.
by iamtew 8y ago
You could just GPG sign your commits, then you can know for sure where the commit is coming from.
- zaarn 8y agoAnyone can create a GPG key and start signing commits. GPG does not solve identity, it requires additional networking (like WoT or TOFU) before it can begin to function as an identity tool.