If you autosign every commit then you aren't validating anything anyway. All that means is you have another mindless process running automatically in the background. So what's your point?
1. Someone got access allowing them to push commits.
2. Someone got access allowing them to push commits and also got unrestricted access to the trusted PGP key.
In the first case, auto-signing will expose the issue. In the second, not. But in the second case, you're likely screwed in many other ways.