GitHub will only let you add a GPG key if you have verified your email address.

So, yes you can of course have Verified name spoofing, but at least the email in git commits can be trusted.