You could just use pgp to sign your commits as a starting point