A git factoid plugin is a great idea. What exactly is the attestation that you have in mind? You provide the name of a repo plus a tag, and the VN issues a certificate of the hash?
I can see uses extending beyond tags, where people wish to claim that code existed at a particular point in time. It's possible to fake the git metadata and push the faked commit. If your notary can say that a particular commit was public, you raise the bar from changing the system clock to inventing time travel (or hacking the notary, whichever is your cup of tea).