That's what having a trustworthy timestamp solves. A key is revoked at a known time, so being able to know if a commit was signed before or after the time of re

That's what having a trustworthy timestamp solves. A key is revoked at a known time, so being able to know if a commit was signed before or after the time of revocation lets you know what the key to use to validate should be. If you don't have trusted timestamps it is a little harder to trust the git commit timestamps. Those can be altered and you need to add additional checks like comparing with what your code review service says (which can be altered..) or requiring that timestamps increase for each commit (which has edge cases..)