Earlier quoted context omitted.
I'm interested in your comment about the cryptographic nature of git objects. I know that hashes are used to identify commits, but I'm not sure how Git uses cryptography elsewhere — e.g. to check the integrity of repos, as you said. Can you explain this aspect in more detail? (Not being argumentative; just curious.)
In git a commit is basically the root of a Merkle Tree [1], i.e. every reference is the sha1 sum of the object being referenced. If you take a commit apart what you see is a commit message, a hash of its parent commit and a hash of a tree object. That tree object itself contains hashes of file objects and tree object as well as their corresponding names. Thus assuming you would want to tamper with a file of a commit…
Actually they have almost exactly the same Merkel tree (there are some minor differences in the metadata that is included, mercurial also includes the file level parents while git does not, for example).
The inspiration came from Monotone.