I mean, Git commit signing should be used more often... then you can actually trust the person signing, not the distribution method

But you still need SHA256 for that