Personally, I only sign tags on the OSS projects I lead. If you do it on a per-commit basis, it's yet another hurdle that a contributor has to go through. That may not be a consideration for OpenWhisk as it already is a complicated project for the inexperienced to contribute to.
Regards, Rob > On 10 Jul 2018, at 16:41, Rodric Rabbah <[email protected]> wrote: > > Who knows why we haven't enabled signed commits on the apache repos - > should we require all commits to be signed? > > -r > > Ref: https://help.github.com/articles/signing-commits-using-gpg/
