title: How to verify the author of each commit in git
body: <p>I'm studying a migration from subversion to git. For starters, a central-repository scheme will be used, just like svn.</p>
  
  <p>The problem is that I want to make sure each commit was created by the real person.</p>
  
  <p>In subversion, assuming you <strong>don't</strong> cache your svn password, you can be sure the commit author is the real author.</p>
  
  <p>From what I read after countless searches on the net, I should create a <strong>signed tag every time I push</strong> the central repository. In order to sign the tag, I should review <strong>each</strong> of the previous commits, to make sure no one changed anything while I was away from the computer (for example introducing malicious code and removing it later, making it invisible in the overall diff, but still being executed in the continuous build/test server).</p>
  
  <p>This means I have to double-check commits: first when I create each commit, and then again when I decide to push with a signed tag. But that is time consuming and redundant. If signed tags are the way to go, then I suppose I should be creating <strong>a signed tag for each commit</strong>. Which will fill the entire repository with tags. That doesn't sound quite right in my opinion.</p>
  
  <p>The cleanest solution I can think of, is <strong>signing each commit</strong> (supported since <a href="http://git.kernel.org/?p=git/git.git;a=blob_plain;f=Documentation/RelNotes/1.7.9.txt;hb=HEAD" rel="nofollow">git 1.7.9</a>). But for some reason I don't understand, doing that is <a href="http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-tp2582986p2583316.html" rel="nofollow">totally stupid</a>. Supported by git, but still supposedly stupid.</p>
  
  <p>What am I supposed to do? Waste time double-checking all commits and doing per-push tag-signing; or tag-signing every single commit; or sign every single commit? Is there an alternative I don't know about?</p>
  
  <p>Thanks in advance.</p>