[njaremko]

I think letting me give you a gpg private key and you sign commits with that would be ideal. I'm not sure how the app signing commits would work, since it needs to be signed by a member of our org I believe?

[Xiulung]

Yep, our app signing the commits would mean requiring your org to approve the app as "someone" who can contribute to the repo

[amtamt]

then why not let them generate the key itself?

[njaremko]

So I can revoke the key if I need to (my understanding is that you need the private key for that)