How do you go about verifying signatures and making sure the code signing verifies every time you push/pull code?
Does your team rely on GitHub's server-side verification?
It doesn't hurt to shore up on security, but given the expense of operating a GHE installation, the fact that there are some GH niceties that don't work quite right there, and that even in just a few months of use GHE already has a poorer availability record than the public GH cloud, broad code signing might have been a better approach.
We do sign in a few places like for our internal deployment tool that gets widely distributed to all engineers, and which checks its code signature before allowing a deploy. It works pretty well, but the fact that GitHub's "merge pull request" button exists (which will create a merge commit on `HEAD` without a valid signature) tends to cause a fair bit of inconvenience.
I'd definitely be curious if others have been making this work.