My point is that what you describe will be detected even before the commit reaches the master repo with the culprit fired as long as you have sensible processes

My point is that what you describe will be detected even before the commit reaches the master repo with the culprit fired as long as you have sensible processes. That's why I don't think commit signing adds anything within organisations. It might be a bit different with public open source repos on services like Github though I don't know how how to verify signatures...