Document commit-signing requirement and re-enable

[reefdog]

For a brief period, we had this repo configured to require signed commits. That's a good requirement to have, but it should be documented so that contributors aren't surprised.

Let's:

• Document the requirement
• Re-enable that setting in GitHub