I’m thinking that a chain of commits signed by authors may only be merged into the “mainline” by maintainers, the merge commit will be signed by one (or more ?) maintainers. A list of maintainers and the repo/fork’s URI can be written into the git tree such that anyone can verify the repo state without looking at any nostr event.

To find the top commit, you verify the repo state communicated by the relay that you have decided to trust or that you are running.

What do you think? What am I missing?