From " 1.5.2. Goals for specific attacks to protect against" from the TUF spec:

Git protects against:

    * Arbitrary installation attacks. (Because metadata is signed)
    * Extraneous dependencies attacks. (Because metadata is signed)
    * Mix-and-match attacks. (Because a git commit hash depends on its parents)
    * Rollback attacks, assuming you make sure you only fast-forward when pulling.
    * Wrong software installation.

It does not protect against:

    * Indefinite freeze attacks. The attacker could 
      just replay the same signed git repository for a long time.
    * Vulnerability to key compromises. (Everyone can sign any commit, no separation)

It also has no built-in support for mirrors, and you cannot delegate trust to sub-maintainers easily, since any person who can sign a commit may potentially modify every file in the repo.

So I don't see how `git` is a valid solutions to the problems that TUF wants to solve.