Vigilant mode exists, and would have flagged the malicious commit as unverified in this case. Maybe it should be the default. https://docs.github.com/en/authen

Vigilant mode exists, and would have flagged the malicious commit as unverified in this case. Maybe it should be the default. https://docs.github.com/en/authentication/managing-commit-signature-verification/displaying-verification-statuses-for-all-of-your-commits https://docs.github.com/en/authentication/managing-commit-si...