You could have them do it, but it&#x27;s just going deeper down the rabbit hole. The eventual question is &quot;who&#x2F;what do you trust?&quot; - maybe it was the git server that got pwned?<p>A PGP-signed commit with a key generated on a smartcard (and never exposed) is a little better, but ... Someone pwned RSA before, and I&#x27;d be surprised if Gemalto and Yubico (just two examples) don&#x27;t have some Three-Letter-Agency backdoor (and .. I&#x27;m sure those TLAs have equipment that can read modern smartcards).