Yeah, I just emerged from the Git code myself ;-)<p>So you&#x27;re correct that GPG-signing commits (but not tags) prevents collisions in commit objects.  The problem though is that a commit ultimately contains a SHA-1 hash of a tree object, so now the concern is someone generating colliding tree objects.<p>Edit: fortunately, the format of tree objects looks pretty rigid.  I feel somewhat reassured, but only somewhat.