Comment by Vogtinator

I treat "signed by GitHub's verified signature" equivalent to unsigned. It's not the author's signature, just some third party's.