Verify signed commits

Verify that commits on release branch v2.4 are signed and that signatures are valid. Run the verification on the last 50 commits, list any commits without a valid signature, and produce a short report naming the commit SHA, author, and why it failed (unsigned, bad key, or untrusted key). For any failures, recommend whether to re-sign, replace, or accept unsigned history.

Before I send this verification report to the release manager, make it easy for them to approve: surface the total signed percentage up top, put the three problematic commits with highest user impact first, and flag whether failures are because of untrusted keys or missing signatures. Suggest remediation options and estimate the disruption of each option.

I ran a verification over the release branch and found five commits that fail signature verification. I do not know whether the failures are due to missing signatures, expired keys, or our key not being trusted in the project's keyring, and I cannot fix all of them before the release window closes. What's the most likely cause and the best immediate remediation to keep the release moving while preserving auditability?

We keep shipping releases where most commits are signed but a few fail verification, and later we rework history to fix them. What regular habit and tooling change would stop this rework and keep a clean verified commit list for releases? Propose an automated verification step in CI and a policy for handling a small number of unverifiable commits during release.