we need the commit object for the updated verification that also checks the committer's email to match the gpg key and user's emails.