[steebchen]

Does commit signing really solve this? I believe you can restrict branches to only allow signed commits, but since these commits are not in any branch on that repository it looks like that wouldn't change anything. Correct me if I'm wrong, though.

[mschuster91]

That yes, but at least the github/gitlab/... UI could refuse to link unsigned comments to the userpage belonging to the email in the commit.