If the attacker has access to your remote repo then isnt that the problem? You can sign your commits all day but you have more serious issues to attend to.
I started to sign all my commits in bzr, hg and git since more than 1 year, and it's very easy to do it: you should try to do it as well
(I disagree with Linus and other people who argue that you should just sign the merge commits, since otherwise you'd be "inflationing"/reducing the value of signatures if you'd sign everything: it would be like only signing the very important messages with gpg, and not doing it for the remaining majority: it's fine if you want to have deniability for your unsigned messages, but that's not what I want for my commits: ideally I'd want all of the changes to be auditable)