If a solution to this is really needed (which seems somewhat dubious), github could allow people to register pgp public keys with their account and then users could sign their commits. Github could then indicate that a commit is verified as being from that user.
Git already has this, it is already a thing, since 1.7.9. I can sign my commits, you can validate my signature, if we both care, it is out there already.
I'm aware. I'm saying github could provide an interface to indicate verified signatures to the github account. It's because git has signed commits that this suggestion is even possible.
Comments
If a solution to this is really needed (which seems somewhat dubious), github could allow people to register pgp public keys with their account and then users could sign their commits. Github could then indicate that a commit is verified as being from that user.
Git already has this, it is already a thing, since 1.7.9. I can sign my commits, you can validate my signature, if we both care, it is out there already.
I'm aware. I'm saying github could provide an interface to indicate verified signatures to the github account. It's because git has signed commits that this suggestion is even possible.