There's signed commits, yes. Is there also "apply these but only if they have a valid signature from one of these people"? That's what I didn't see.