check gpg signed commits