Also note that until you can individually get the good actors' public key you can't verify their commits. So it's not enough to distribute the instructions in this webpage, you also have to have a trusted key exchange. Everyone who wants to verify commits will need a copy of everyone who might sign commits' public keys.
If you trust github then you can use them as a key broker like the "User SSH Keys from GitHub" section suggests, if all of your committers are github users.
This would need to be coupled with a "reject unsigned commits" policy on push. For example - https://docs.gitlab.com/ee/user/project/repository/push_rule...
And note that the caveats that it has would require the person to log in to gitlab to not need to push (by using the webIDE instead) which leaves an audit trail there.
Similar functionality can be crafted with a pre-receive commit hook - https://docs.github.com/en/[email protected]/admin/polic...
An example of such a hook - https://github.com/github/platform-samples/blob/master/pre-r...
Additionally you can enable "Vigilant Mode" to make it obvious when commits are untrusted.
https://github.blog/changelog/2021-04-28-flag-unsigned-commi...
commit 3c2f202543b31e9d7e2fff92a211a0f37ebcca9b (HEAD -> master)
Author: Dave <[email protected]>
Date: Tue Sep 13 21:32:41 2022 -0500
I am not smart.