Unsigned commits look suspicious. GitHub shows "Verified" badges on signed commits, proving they're authentic. Signing commits with GPG within CI is tricky. Signing commits with SSH is much simpler.

[](https://www.youtube.com/live/Xv5swK8gwAs?si=fg7udrZ6dWFtbvNH "Brachistochrone ...