Add support to verify GPG signatures for git modules (git.latest, git.cloned)

[chr4]

Is your feature request related to a problem? Please describe.

When using git.latest I require an option to verify the GPG signature of a commit before continuing.

Describe the solution you'd like

An option like verify that uses --verify-signatures when doing git pull.

Describe alternatives you've considered

I've tried using git.config_set to deploy this to ~/.gitconfig:

[pull]
  verifySignatures = true

Unfortunately git.latest doesn't seem to respect the options in .gitconfig.

Additional context

Maybe a generic option for the opts parameter in def pull() would also suffice, where one can manually set --verify-signatures.

[dwoz]

This feature request was moved out of the issue tracker as part of a backlog cleanup — there is no active development commitment behind it. If you intend to implement this, please leave a comment and a maintainer can convert the discussion back to an issue to track the PR.