> I probably would never trust a public commit history as some kind of source of truth

What _would_ you trust as a source of truth for source code if not a public commit log? I agree that a squash commit’s timestamp in particular ought not be taken as authoritative for all of the changes in the commit, but commit history in general feels like the highest quality data most projects will ever have.

Until you realize it’s trivial for an LLM to fabricate it in about a minute

I really hate when cryptocurrency has valid applications but in this case, you're looking for a public adversarial append only log system which is what a blockchain is.