[cesarb]

We have 8-digit PGP short IDs for the same reason we have abbreviated 7-digit hashes for git commits (`git rev-parse --short`): it's short enough to keep in one's head (see https://en.wikipedia.org/wiki/Seven_plus_or_minus_two).

[VMG]

But you usually don't have to worry about adversarial input when you check out a local git branch.