[fetch] support verifying signed git commits

It would be really cool if the git source could verify a commit was signed with a GPG signature. This seems like a nice middle ground between not really wanting to give our GitLab access to a serviceAccount with really broad permissions, but also not wanting to set up really fine grained deployment roles per application.