In both cases, you're leaving a paper trail that you were involved. In the first, you approved bad code. In the second, you asked someone to approve bad code.

In both cases, you're leaving a paper trail that you were involved. In the first, you approved bad code. In the second, you asked someone to approve bad code. Of course, who knows how long that bad code could sit in prod before it gets noticed is a toss-up, and preventing it from happening is going to be infinitely better than just logging it. Got any other scenarios that commit signing would solve?