Sigs are not important if they hold the repository to start with. Why not? Someone can clone the repository and verify using my public key that I signed a comm

Sigs are not important if they hold the repository to start with. Why not? Someone can clone the repository and verify using my public key that I signed a commit. If GitHub modifies the repository, the chain of hashes changes, and the signature would be incorrect. And, in any case, sigs do not prevent malicious code changes. That is true. But if every commit was signed using a known signature, then you know who injected the malicious code. For a third party to inject malicious code, they would have to compromise the one committer's machine and/or key, rather than GitHub or a specific GitHub account. Also, once the attack is detected, you know which commits are potentially bad, namely those signed using the compromised key.