It’s worth noting that only GitHub will do this, since they are the root of trust for this signing scheme. This is wrong : the commit signature is stored insid

It’s worth noting that only GitHub will do this, since they are the root of trust for this signing scheme. This is wrong : the commit signature is stored inside git: commit 96afe9a2af7d72fbd6cd790143388c47d9f91d3e (HEAD) gpg: Signature made Thu 28 Sep 2023 10:12:38 AM CEST gpg: using RSA key 653A3D280EB42CB78CF327CFEDDED470D80A522C gpg: Good signature from "Jack <jack@domain.com>" [ultimate] Author: Jack <jack@domain.com> Date: Wed Sep 27 10:00:24 2023 +0200 commit message The author seems to miss a lot of git internals : the name and email in the commit message are nothing but text, everybody can write anything. The one who wrote a commit may not be the one who push the commit in github (or in any kind of remote). But reading the "pro/con" at the end of the article should be enough to throw the whole things away :/