So, I've skimmed through most of the paper, and it seems like a bit of an apples to oranges comparison. My understanding is that GV2 is an extension to jGit that essentially performs GC on the repo (or more accurately waits to encrypt until post-GC), and then transparently encrypts everything altogether, rather than utilizing clean/smudge filters to encrypt files individually like the tools it's comparing itself to. It's funny that the author dismissed git-remote-gcrypt as being "under development" even though it's a much closer comparison to GV2.

The paper mentions that it's measuring the worst-case scenario for the clean/smudge filter-style tools as it's much more likely that you only need to protect a few files and not the entire repository, but I didn't see how the second section actually reflected this more-realistic scenario. I'm not saying that encrypting the entire repository is bad, but the overhead of using filters to encrypt the entire repository is a documented/known limitation of the other tools...so it seems a little odd to gloss over that.

Side note, stuff like "This process is repeated a total of 10 iterations for an ample sample size to draw statistical conclusions." worries me, but that's another conversation.

Overall though, glad to see more research in this area, and it sounds like GV2 might be a decent solution for people looking to protect their data in certain scenarios.