[scrollaway]

I was only talking about git commits though. For tags we agree, as the tag is only a pointer (https://twitter.com/Adys/status/835595116110823425).

But for the commit it's different, because the $text in your example affects the hash of the commit itself. And my understanding is that if you sign the commit, you're signing both the contents and the hash of the content. Am I incorrect?

[glandium]

If you sign the commit, you sign the exact text I quoted, where $text is what you pass to the `-m` argument to `git tag`.