That's by design: if you know a Git commit ID, you automatically also know the history hasn't been tampered with (modulo hash collisions). Linus specifically wanted a system where development history cannot change behind developer's backs. Given that the other big design constraint of Git was distributed version control, I'd argue that this is a very important property to have. You don't want to pull in someone else's branch and suddenly have all your own developer history change.