> You would never do so for normal internet activity like Google searches, Twitter or Facebook Websites from Google search result are verified by my browser vi

> You would never do so for normal internet activity like Google searches, Twitter or Facebook Websites from Google search result are verified by my browser via HTTPS certs. On twitter or facebook, users usually trust the centralized authnz systems hosted by the platform to verify content ownership. But out of box, git allows you to use whatever name/email on your commit, so that's a problem. In my whole career, there were 3 times that I got questioned about "why did you introduce this line of code, which caused some production issue?" and turned out to be results of someone junior developer's rebase/amend or whatnot. I pointed out that I always sign my commits and those unsigned ones were not mine. Without signature I really could not tell whether I was the author or not, since some commits are months/years old. I believe those altered commits were honest mistakes without malicious intention, and our organization has blameless culture. But I still want to let my coworkers know that I am not the one who caused this problem. Signing commits helps a lot in these situations and clears misunderstanding, and I believe more or less impacted my performance review and bonus (my performance would probably not be as good if I had to own those incidents). CI/CD tools are getting better each day, a commit can mean a lot more than "a snapshot of the code base", like, it could have been a checkpoint of the state of the production environment (IaC, GitOps ... etc). You already have your name on the commit, so why not offer a way for others to verify you are really who you say you are? And I should probably clarify, that the identity of a git commit does not have to be linked to a human in real life. It's just a way to verify that a commit is really from author X and not Y.