we need the commit object for the updated verification that also checks
the committer's email to match the gpg key and user's emails.