My point is that even making calls to the GitHub API and archiving the results (signed by the fetcher, of course :-) can't produce an audit trail and artifacts

My point is that even making calls to the GitHub API and archiving the results (signed by the fetcher, of course :-) can't produce an audit trail and artifacts you can use to reconstruct the commit signature validity history. Now if you merge a PR, it will be signed by the person who committed the merge (or rebase). Thus the problem is simpler than full-blown distributed PKI (at which point some salivating shill will of course trot out the blockchain as universal panacea). You need to ensure the signature keys of all committers (a much smaller problem than the universe of all possible contributors) and their timestamped history are known and kept somewhere in the repo. One solution would be to define a standardized file format similar to the SBOM standards CycloneDX or SPDX) to record this log (I suppose its generation and maintenance could be automated by a GitHub action), and signed by a comitter. This file can then be used to validate all the signatures even if GitHub falls off the face of the Earth. There is a bootstrap problem for how the many committers on a project trust each other, but that is handled by GitHub or whatever mechanism was used to convene the committers together in the first place.