Hacker News Reader

It's that serious? Wouldn't the offended party just ask for the content/service/repo be removed?

With the digital footprint these days, that might impede employment in the future in certain industries or sectors, especially if it’s tied to your name.

>if it’s tied to your name

How can this be proved? Even with signing, anyone can impersonate anyone.

The entire point of the signature is that it can't be forged. If a commit is signed with your private keys, I can reasonably conclude you authored it.

I know this is a solved problem in certain contexts, but realistically how does a third party prove that your private keys are yours?

Because if you're signing your commits you're probably also the type of person to sign your email with the same key.

Adding a data point to your statistics: I sign commits and packages I maintain (when it applies), not my emails.

Obvious recent case is Tornado Cash.

is it not enough to sign it and burn the keys?

PGP encrypted public messages is common even on the dark web.