Agreed.<p>It should be trivial for them to allow you to paste your pgp public key as you would your ssh public key, then place a nice little &quot;verified&quot; check mark next to commits that can be validated as having been signed with one of your associated private keys.