Well, git commits can be signed by they're authors, verifying authenticity.

This would prove if malicious commits have been added to a mirrored repository.