If a commit is signed, one can verify that the author is indeed who s&#x2F;he claims to be. See <a href="https:&#x2F;&#x2F;git-scm.com&#x2F;book&#x2F;it&#x2F;v2&#x2F;Git-Tools-Signing-Your-Work" rel="nofollow">https:&#x2F;&#x2F;git-scm.com&#x2F;book&#x2F;it&#x2F;v2&#x2F;Git-Tools-Signing-Your-Work</a>.<p>Some excerpt:<p><i>Git is cryptographically secure, but it’s not foolproof. If you’re taking work from others on the internet and want to verify that commits are actually from a trusted source, Git has a few ways to sign and verify work using GPG.</i><p><i>In Git 1.8.3 and later, “git merge” and “git pull” can be told to inspect and reject when merging a commit that does not carry a trusted GPG signature with the --verify-signatures command.</i>