> this would then show up as an attempted forgery, rather than a perfectly normal workflow.

they said unverified, not marked as a forgery

> The email field is for humans, who can lie, and shouldn't be used as authoritative by github.

and your solution is just to have everything marked as unverified, including commits that I push using my credentials and contain an email that I've verified with github.