Given that this action is widely used and can read other security events (arguably a github flaw), it's probably worth making sure all commits are signed for added peace of mind.