> Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities. This would need to be coupled with a "reject unsigned

> Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities. This would need to be coupled with a "reject unsigned commits" policy on push. For example - https://docs.gitlab.com/ee/user/project/repository/push_rules.html#prevent-unintended-consequences https://docs.gitlab.com/ee/user/project/repository/push_rule... And note that the caveats that it has would require the person to log in to gitlab to not need to push (by using the webIDE instead) which leaves an audit trail there. Similar functionality can be crafted with a pre-receive commit hook - https://docs.github.com/en/enterprise-server@3.2/admin/policies/enforcing-policy-with-pre-receive-hooks/creating-a-pre-receive-hook-script https://docs.github.com/en/enterprise-server@3.2/admin/polic... An example of such a hook - https://github.com/github/platform-samples/blob/master/pre-receive-hooks/block_unsigned_commits.sh https://github.com/github/platform-samples/blob/master/pre-r...