[github hardening] signing commits