Requiring and enforcing known-key gpg commit signatures

[Collin Funk]

"Andreas K. Huettel" <dilfridge@gentoo.org> writes:

> we've made good experiences in Gentoo with requiring and enforcing (on push)
> known-key gpg commit signatures. [1,2]
>
> How about introducing this for glibc too?
>
> The signatures would improve verifiability of the repository [3] and
> the ability to trace back events in case of a (gasp) compromise.

It isn't a problem for me personally, but I worry a bit about committers
who may not have experience with GPG. I'd assume some may not even have
GPG keys, unless they need them to make releases for another package
they maintain, for example.

Perhaps I am overestimating how many people will run into trouble there.
Or perhaps it could be solved with documentation in the Wiki?

Collin