Public Git hosting

the issue is that the e-mail requesting the pull can be forged, and since anyone can get a github account, how do you know the pull request is really from the trusted person?

if someone is requesting a pull from a place that is known to have done user verification this isn't an issue.

note that this is not saying that you have to have an account on one of these trusted places to participate in kernel development. it's just the final layer (the lieutenants and maintainers sending their pull requests to Linus) that is has this requirement. This is so that Linus can trust the source he is pulling from, at the lower levels the patches are supposed to be validated more directly so there is less need for trust.