It's very easy to change identities online. That's why throwaway accounts are a thing... If you start trying to ban based on IP, then you're in the cat/mouse game that IRC folks have been fighting for decades.
You can solve this though a few user interaction metrics. I'm not active on hacker news thus I don't have privileges (karma) to down vote. A brand new account shouldn't be allowed to make a change such as this, getting enough reputation should require active involvement and code review of changes before they are accepted. Just as my karma can drop, people should lose privileges. That this is sensitive piece having high security requirements means that bar can be even higher requiring years of involvement before unverified commits can occur.