should we enable signed commits on our github repos?

[Rodric Rabbah]

Who knows why we haven't enabled signed commits on the apache repos -
should we require all commits to be signed?

-r

Ref: https://help.github.com/articles/signing-commits-using-gpg/