Conversely, if you do sign your commits but are careless if your keys (e.g. storing your private-key directly in your repo...) then you've got even more work fo

Conversely, if you do sign your commits but are careless if your keys (e.g. storing your private-key directly in your repo...) then you've got even more work for yourself.