I tried using git notes for distributed secure reviews but hit some road block with merges. It is a good idea that has limitations that limit its adoption