It's more of a meta question/suggestion than the actual issue, but…

Why don't you guys sign your commits?

It's quite trivial to set up and even to link with your Keybase identities. It seems like quite a reasonable thing to do on a security and privacy concerned, E2E encryption project :).