It would be a lot more workable if "Update with rebase" created signed commits. Without that, if I want to land bugfixes today, I have to check each out locally and do the rebase myself --- which also looses the author's signatures. I can't recall seeing a main branch break due to merging a conflict-free PR. How big of a risk are we mitigating with this?