Git's Signed-off-by: is such a ludicrous thing, made even more ludicrous by people who have checks that the author of a commit has the same email as the person who signed off.

I would be shocked if a court decided it matched the legal requirements for a binding contract in any context where the git commit itself did not. Checking that two fields match, when you have no way of validating that the person who created the commit is actually the person identified by either is a complete waste of time.

And it also incurs some fun GDPR liability. Now you have an email address in the commit message, as well as the author metadata. How do you comply with a legal requirement to remove personal information from your history?