Git 1.7.9 added the ability to sign commits. Previously you could only sign tags:
* "git commit" learned "-S" to GPG-sign the commit; this can be shown
with the "--show-signature" option to "git log".
man git:
All objects are named by the SHA1 hash of their contents, normally
written as a string of 40 hex digits. Such names are globally unique.
The entire history leading up to a commit can be vouched for by signing
just that commit."
