This is actually a very good and interesting question. It would be good if Github started to at least show signed commits and on a per repo level block non-signed commits.

And Git should migrate to something better than SHA1.