Earlier quoted context omitted.
There is a distinct lack of decent identity management/security in all of the version control systems I've used. It's a hard problem to solve, especially in a distributed/decentralized system (like git). Signing git-style commits is problematic in the face of merge conflicts or rebasing. A patch-style system (like Pijul) probably makes this easier: if everything is a patch, every patch can be signed atomically. I'd r…
I don't see why the git way is problematic. It means someone is verifiably taking responsibility for all changes. That applies to conflicts and reading as much as normal commits. Edit: I'm not saying there's not a better way, just that I don't understand the problem with git.
1. You could retroactively sign something with an expired key and rewrite history
2. The one doing the conflict resolution signs the whole merge commit, but didn't author the stuff they're signing.