You don't even need that for historical integrity checks either. As long as the commit history exists in two places, it's trivial to detect when one has changed

You don't even need that for historical integrity checks either. As long as the commit history exists in two places, it's trivial to detect when one has changed, due to the merkle tree structure of the commit log. Signed commits are a nice way of also sealing that history and validating authorship or approval of some sort.