GitHub Templates and Signed Commits

[dagpunk]

I noticed when testing GitHub templates that the initial commit is unsigned. GitHub has a security setting you can enable to require all commits to be signed. I've done this and also activated vigilant mode.

When I create a new repository from a template, the initial commit is unsigned. At first, I was concerned how this might interact with the related security features, but it turns out that this initial commit's signature is ignored by those rules. This may be due to the checks occurring at the PR level (no commits added by a new PR can be unsigned).