The issue is mostly with git itself, e.g. take a look at git cat-file commit HEAD to see something like: tree <tree-hash> parent <parent-hash> author

The issue is mostly with git itself, e.g. take a look at git cat-file commit HEAD to see something like: tree <tree-hash> parent <parent-hash> author <author-name> <author-email> <timestamp> committer <committer-name> <committer-email> <timestamp> gpgsig -----BEGIN PGP SIGNATURE----- <ascii-armored RFC9580 signature> -----END PGP SIGNATURE----- <commit message> You can view an example of the structure of this ascii-armored signature here <https://cirw.in/gpg-decoder/#-----BEGIN%20PGP%20SIGNATURE-----%0A%0AiF4EABYIAAYFAlX5X5UACgkQjP3hIZeWWpr2IgD%2FVvkMypjiECY3vZg%2F2xbBMd%2FS%0Aftgr9N3lYG4NdWrtM2YBANCcT6EVJ%2FA44PV%2FIgHYLy6iyQMyZfps60iehUuuYbQE%0A-----END%20PGP%20SIGNATURE----- https://cirw.in/gpg-decoder/#-----BEGIN%20PGP%20SIGNATURE---...>. You can add a patch to git to support more signature types than just OpenPGP. You may then be able to move mountains and get GitHub/others to join in the validation. Finally, if you can find bugs/exploits in GnuPG, you should report them and you will definitely get credit and recognition for them. They are not trivial to find.