Sign a claim about a commit

Attach a signed statement — “reviewed”, “deployed”, “tested” — to any commit. Anyone holding your public key can verify it later, on any tool that reads the same envelope.