Adding signatures is, IMO, more “this will give you more data points to help figure out the edges of how much a contagion had spread during a compromise” than “yay we stopped compromises.” slightly-barely-weakly-thumbsup on requiring signing. That said, “ugh” to the clutter from PRs going up and getting stuck because they’re unsigned.