Proposal to sign all commits

[Kus]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi Jo,

Never done it in a real project. Signing commits should not make things any worse. The worst thing that can happen as far as I know is we are back to where we are today.

Rewriting history can be a pain from what I've read. However, I think it is a bad idea to rewrite history once we have landed something to a publicly available release branch. What do you think? Would it be acceptable to forgo the ability to rewrite history for the sake of added confidence?

I also like the idea of an integration server that builds the code after every commit and runs tests. Don't know if we have that today but it would be a good nice to have.
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQJRBAEBCgA7BQJXKnDvNBxLdXNoYWwgSGFkYSAoZGV2ZWxvcGVyKSA8a3VzaGFs
ZGV2ZWxvcGVyQGdtYWlsLmNvbT4ACgkQJsInd2b1xmNw9Q/+O21MIx0z0HapAUS2
WTqbe0OpRtY1NR5WBealZR9vyssmVIu82M4sKnVht8Ehu0vpFIKkCLHEpY34O4HU
9fT/rkiTgdGUWrLgEKYP2qq2OL1OD5t3kqZTc4TbbGpZnFoZo6ir6/9nj1ixns4W
C+EFHWKiHPc8+cispojrt3YyzK0TVnLPIbTYqJgYi0kQylKPprNUyLSSbNIpKZL/
AuiTGW0tk1WZOFKugvUfa6N8xOgSYMOucqFr/MZWaRTE5sn3cyyNS1f+e5Y+hf0/
OW+d6esanwbquvlGdRzQ0frebSDATNL7G+H+xUWWV2XDh7vBlYZZQ157jDH5BbZ2
b0yGq6M2HWIWi0URMDNzEMb0mnbHzWJ/F3K2meCRP5MAlSvvF5VW+xzgnJVWjf9k
27UCIZbsidCabchci+E/BAc+jRlfNAjLsHu8nU43lclkhqoXSiTNmed5vwZSAFvf
qD9zjmHdzQvBGhdXVWlO0ntCQchKgUkfQG55h6gwVqwqZToH4f7FbdvPkhlMYI8N
knSbwGeg7uFlS24cfLkPzJ85o3QfMJ96fsUc0CiepmoINuF4N/e2TU4M33PmHDCY
fAvPMN2bRWlZTMwSoXwKij82w4yn3JwTk/dGmEZdd+77ZhrAGbG15nHmicrnU/TE
fr5fPvqSU4yzusF0fkIkRgZjCsc=
=rh2o
-----END PGP SIGNATURE-----