Hacker News Reader

But how does the hacker's commit goes through in the first place, if all PRs with unsigned commits are rejected outright?

If he hacked the server (which was assumed in the grand parent), he can probably shut off that check rather easily

And then you have a singled commit without a signature lying there for everyone to see and call attention to you.