If they were able to get your keys to push a commit or sneak code into your branch we are waaaaay past the territory where a signed commit can be trusted.