Hi,
> after merging one more translation pull request, just by trusting the
> From header, fingers crossed that if an attacker had been spoofing
> this header to game us, then the person being spoofed would notice
> before any user is harmed... I'm wondering:
>
> Would it sound crazy, too painful, or what, if we required l10n pull
> requests to be OpenPGP-signed?
