Since the app has the availability to configure GPG keys and allow signing commits, it should also have the option to sign the actions. Neither cherry-pick, revert-commit, merge-commit nor rebases are signed again. Each of this actions destroy (obviously) the signed commits, but will not create new ones.