To be fair the commit time and the authorship time are not the same. You can author something at work and wait to get home to commit it and vice versa.
Unless Github has some backup logs somewhere, that entire log can be wiped out and replaced with whatever someone wants with a simple `git push -f`.
Which is why it's so important to sign commits. You sign your commits, and keep your private key private, and as long as any copy of the repo exists anywhere you can access, you can prove authorship/ownership.
Commit signing is also very useful for vouching for code integrity.
[0] http://blog.printf.net/articles/2015/05/29/announcing-gittor...
No, for this to work, you'd really need to timestamp either the git tree hash or (preferably) the hash of the GPG signature (or the signature itself).
Most timestamp service hashes are necessarily public (for trust reasons), so an attacker could grab one and go back and include it in his signed commit message.
But if you timestamp your commit hash (which is a cryptographic hash after all -- albeit an increasingly weak one) or timestamp the signed commit, then it can't be forged (since the attacker can't go back in time and use a cryptographically-verifiable timestamp, like the ones indelibly embedded in the blockchain).