The part that jumps out is the multi-device setup, because once the signing key lives on more than one machine, the practical guarantee is mostly “same key used here” rather than “this person approved it.” I’m a little surprised the study still treated verification as a repo-local exercise, since without a pinned trust root or allowed-keys list, checking a signature tells you very little about the identity behind it.

If the study found the signatures were mostly misunderstood, what are people actually supposed to trust here, the author identity, or just that a particular key was available on the machine when the commit was made?