I think I used the word vouch incorrectly. When you sign a commit you indicate that your changes can be applied only on that particular parent even if all files or diffs were bit for bit identical. If it didn't work like that someone could take your work and place it in a completely different project and claim it was signed by you.
Note that even with signed commits there are same gaps in the system. For example without signed pushes someone can take your signed commit from branch "test" an push it to "master".
Similarly, if I sign a commit containing `parent 085bb3bcb608e1e8451d4b2432f8ecbe6306e7e7`, that says nothing about whether I consider all previous commits to be valid. It only says that the commit I just signed was created based off of that parent commit, and that in order to see the changes I actually made you'll need to diff against that parent. (Which `git show <my commit id>` will do automatically.)