Switch to using fingerprints for keyid matching in check-commit-signature.
Fix stupid mistake and put "$" around two variables in check-commit-sigature.
Put an exit code check where it belongs in check-commit-signature.
Fix strange whitespace variation in check-commit-signature.
Change git rev-parse checks in check-commit-signature and add checks for hex.
Fix misnamed variable in check-commit-signature.
Change config parameter hooks.allowunsigned to hooks.allowunsignedcommits.
Move a hook variable.
Switch to checking for fingerprints in check-commit-signature git hook.
Move checks on revisions HEADs in check-commit-signature to be per commit in series.

 * Add check that a revision's commit hash is indeed hexidecimal.
 * Add check that commit hash is 40 bytes in length.
 * Move commit type checks to be per commit, instead of only checking the
   commit at the tip of the HEAD of the newly pushed revision.
Rename $newrev_type to $commit_type in check-commit-signature.

 * Add safer quoting of variables $rev_cur and $commit.
Change to case switching through $ref and $commit_type simultaneously.

 * Case switch through $ref,$commit_type at the same time in
   check-commit-signature script.
 * Move checks for originating branch, GPG signatures on tags and commits, and
   signing keyids to the top of the case switch.
Add GPG signature checks for merge commits onto master.

 * It turns out there *is* a way to make GPG signatures for merge commits -- it
   has to be done with:

       $ git checkout master
       $ git merge -S --no-ff develop

   To view the GPG signature of a specific commit, we can't use git log, but
   instead:

       $ git show --show-signature "$commit"

   Although, disappointingly, the keyid attached to the signature is determined
   by the system gpg.conf file, which, if set to the default, is the short
   keyid. There doesn't appear to be a way to tell git to tell gpg to use a
   different config file, unless there is some arcane git config setting that
   is undocumented.
 * I'm not satisfied with the checks on the output of "$ git show
   --show-signature $commit", because they could be fooled by putting
   "gpg: Good signature made Sat Mar 23 02:10:24 UTC using RSA key ID 2CDB8B35"
   anywhere into the commit message.
 * There might be a way to get around the above mentioned problem by excluding
   the commit message from the output.
Removed all directly user controlled inputs being parsed for sigs.

 * Before, I beleive that someone would have been able to make a commit with
   the lines "gpg: Good signature..." and gotten the commit to pass the
   checks. Now, there are no user inputs in the bits of the git log exposed to
   the signature check, it should just see the commit hash and the sig.