Suppose someone checks some malicious code into the repo. Without signed commits it can be very difficult to determine or prove who was responsible. That abil

Suppose someone checks some malicious code into the repo. Without signed commits it can be very difficult to determine or prove who was responsible. That ability to audit is important to most companies, and should be important to most popular open source projects as well.