NAPA, Calif. In the immortal words of song developer Pete Townshend, Well, who are you? Who are you? Who, who, who, who? I really wanna know! Linux kernel maintainers have the same question: Who are their programmers, and how can the kernel community be sure the code they submit is really theirs? For decades, Linux kernel developers used Pretty Good Privacy PGP to identify developers and their release artifacts. Git's PGP integration enabled signed tags to verify code repository...
