pull down to refresh

We use SSH that verifies in the same way, PGP wouldn't have changed anything, a botched branch rule on one repo was the gap in preventing the push at all ... and vigilance mode would have flagged it more visibly

We don't distribute binaries that would need a signed hash