Re: Commit signing

> If you don't trust the owner, but you trust the pusher, than using 1
> annotated tag per push is reasonable and gives you something to
> verify the repository owner isn't playing games. If you don't trust
> the pusher than you should be reviewing the changes before deciding
> to keep them in your project.
>
> But even then annotated tags are overkill. You could just receive
> the commit SHA1 out-of-band from the pusher (e.g. email, like
> Junio's hidden X-master-at header) and verify that by hand. 8 digits
> is probably more than enough to hand-verify the entire commit chain
> you are receiving.