Signing commits seems like a pointless mess to me. Being able to use a better git hash function and then using signed tags could be an improvement. Using a Fido

Signing commits seems like a pointless mess to me. Being able to use a better git hash function and then using signed tags could be an improvement. Using a Fido key for both ssh and 2FA is also a great security improvement.