GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures
Research shows signed Git commits can be re-encoded into fresh GitHub Verified hashes without changing files or breaking signatures.
More info