> Git hashes are not supposed to be a security mechanism.

Commit signing indicates otherwise.