How to enable SSH Key Verification with Git and GitHub
With the right know-how, it's incredibly easy to impersonate anyone when making commits. This is a potential attack vector that gives the false impression that code can be trusted and attributed to the named author when in fact it cannot.
Unverified Commits: Are You Unknowingly Trusting Attackers’ Code?