certifying the whole tree instead of a diff
Removing a credential from a repository is a small, satisfying act that answers almost none of the question. The question is whether the tree you are about to ship still contains one, and whether the strings that look like credentials are…