Verify-commit: a signature needs a trust context

Useful to know

git verify-commit checks a commit signature using the supported mechanism and configuration. That is separate from the quality of the code it contains. [1]

Establish which key is expected and how it is linked to the author. A cryptographically valid signature from an unknown key does not automatically prove the intended identity. Signing and code review complement rather than replace one another.