As an addendum to the idea, perhaps have the git commits signed via a public timestamping server. (ie to say, any commits that do not have a corresponding times

As an addendum to the idea, perhaps have the git commits signed via a public timestamping server. (ie to say, any commits that do not have a corresponding timestamped signature will not be accepted). As CT shows, there are other ways to solve the audit-logging-for-untrusted-parties problem.