The Confusing Case of Git Signatures on GitHub

Git has supported signing for some time (version 1.7.9 released in 2012). As git's own documentation says, git is cryptographically secure but not foolproof . By cryptographically secure it means that every commit has a hash value and all future values are built on top of previous values. This makes tampering with the history of a repository extremely difficult without detection. By not foolproof…