Comment by mohsen0

And that is why signing commits should be enforced.