You’re mixing up integrity and authenticity: git provides integrity through its basic design; commit signing additionally adds authenticity (sort of). But agai

You’re mixing up integrity and authenticity: git provides integrity through its basic design; commit signing additionally adds authenticity (sort of). But again: you don’t actually get authenticity if you obtain the public key from the same untrusted channel as the signed material. The key has to come from another channel (another simplification, but true in PGP and git’s case). That channel can be the user’s GitHub profile, website, etc., but it can’t be the repository itself.