Comment by aejm

This is really good inspiration for some of my plain text accounting projects! Could you please go into more detail about your RFC3161 attestation of commits? I'm assuming you're signing your commits with a gpg key to assert that it was in fact you who made the commit. Do you use an external timstamping service and an external ca authority, or do you build your own chains of trust? If you were asked to attest your accounting commits, what would that look like to the auditor?