title: Why does Git need signed pushes?
body: <p>In the release notes for <a href="https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.2.0.txt">Git 2.2.0</a>, it describes a new option to <code>git push</code>, <code>--signed</code>:</p>
  
  <pre><code>"git push" learned "--signed" push, that allows a push (i.e.
  request to update the refs on the other side to point at a new
  history, together with the transmission of necessary objects) to be
  signed, so that it can be verified and audited, using the GPG
  signature of the person who pushed, that the tips of branches at a
  public repository really point the commits the pusher wanted to,
  without having to "trust" the server.
  </code></pre>
  
  <p>So it sounds like the data being sent to the server during the push is signed so that <em>the server</em> can verify and log who did the push.  In the <a href="http://git-scm.com/docs/git-push"><code>man</code> pages</a> you can confirm this:</p>
  
  <pre><code>--signed
     GPG-sign the push request to update refs on the receiving side, 
     to allow it to be checked by the hooks and/or be logged. See 
     git-receive-pack[1] for the details on the receiving end.
  </code></pre>
  
  <p>You look in the <a href="http://git-scm.com/docs/git-receive-pack"><code>man</code> pages for <code>git-receive-pack</code></a> under <code>pre-receive</code> and <code>post-recieve</code> hooks to see exactly how to verify a signed push.</p>
  
  <p>It seems like all of that helps <em>the server</em> verify who is doing the push really is who they say they are.</p>
  
  <p><strong>How does <code>git push --signed</code> help you (the pusher) in not having to "trust" the server?</strong>  Everything I have seen so far seems to indicate that it helps the server trust you.  More importantly, <strong>Why are signed commits and signed tags not sufficient to push to an untrusted server?</strong> Why do we even need signed pushes?</p>