Hacker News Reader

Except that's not how it actually works (you can push fake commits to your repos). If someone can log into your account (to be able to push fake commits to the account's repos) they can also add their GPG key. The point is that no additional security is added by this feature.

View on HN

Without this feature, I can push commits up to my repo and claim they were written by you; with this feature, people can tell whether you signed off on those commits.

So what? That implies that someone should believe someone when they say "look, the email address on this commit says this person's name -- it must be that person!". This all comes down to repo ownership. In your fork of a repo, you have the ability to fake any history you want. Why should that bother me? GitHub should stop auto-associating emails to usernames -- that's the actual problem here.

Reply on news.ycombinator.com