Is it possible to have a Git commit signed by more than one GPG key?
We do a lot of pair-programming and use git-duet, as well as YubiKeys with GPG keys on to sign commits, so we can prove the identity of the committer no matter whose machine we are using. However, it'd be really great if we could also prove the identity of the other member in the pair.
Any ideas on how we could prove the identity of both members of the pair? This would be handy in regulated environments to prove that code has been seen by another set of eyes (and is thus less likely to contain sneaky backdoors).