Hacker News Reader

I think the problem is with identity management.

Maybe a universal identity provider is required.

You could just GPG sign your commits, then you can know for sure where the commit is coming from.

Anyone can create a GPG key and start signing commits.

GPG does not solve identity, it requires additional networking (like WoT or TOFU) before it can begin to function as an identity tool.