Haven't linux kernel developers solved this problem already years ago? Commit signatures, signoff hierarchies. Github could solve it with required signatures

Haven't linux kernel developers solved this problem already years ago? Commit signatures, signoff hierarchies. Github could solve it with required signatures and automated credibility score. When using you'd provide "entry points" that you trust (ie. orgs like google, fb, accounts of people you know etc) and "entry points" you blacklist. You take advantage of directed acyclig graph contributions create (spammer trusting reputable entrypoint is meaningless). Only single, possibly nested identity has to blacklist something to contribute to downscoring whole spammy contribution graph. Negative score can be reinforced by others explicitly blacklisting it as well. I think we'll not get away without anything like that - cryptographic identities, trust graphs etc.