Signed commits and verified tags for supply chain security?

Answer preview

Signed commits prove authorship and prevent tampering — increasingly required in regulated and open-source environments.…