Option to prevent push of unverified signed commits

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Proposal

Provide a push rule to prevent unsigned and unverified commits from being pushed.

Further details

We currently have two related push rules:

• Reject unverified users - which verifies that commits being pushed have the same email address as the user doing the push.
• Reject unsigned commits - which rejects any commit that does not have a signature.

However, even with the above existing options enabled, a user can still push a signed commit that does not correspond to any of their PGP public keys on their account. This leads to the confusing situation where a commit that is clearly marked as "unverified" has somehow made it into the repository despite the above options being enabled.