the updated verification of a gpg signature requires the committer's
email to also match the user's and the key's emails.