Wouldn't untrusted git hooks mean that git verify-* are useless since you're already running untrusted code?
>Wait, I thought git hooks aren't pulled from remote.
You are correct. They are not. Other tools may auto-install them (I hate it), but git does not ever.
(Though not completely sure.)
