Once a repository is initialized, it comes with a built-in authentication metadata that includes a root public key which is committed by the fingerprint of the whole repository, hence immune to forgery.
This root public key. How can you make sure it isn't altered effectively, since repository is distributed among nodes. For example, what forbids a node change it, and send the entire repository to other nodes?
In the scheme, authenticity of a repository is hard-coded to its genesis and is not forgeable ever, though the genesis itself is a different story:
[...]
What I like about your idea is that a Git commit history is one of the few data structures that slightly resemble - and because of that might actually make sense to implement as - a blockchain.
I see 2 issues:
[1] Embedding developer keys in the 'genesis commit' means they can't revoke them, add new ones or add new developers to the project down the road.
[2] You need a consensus mechanism, and as so often discussed on the forum, nothing works as well as PoW (if at all). So either it's built on top of a PoW cryptocurrency like Bitcoin, or you need to incentivize people to 'mine commits' using real-world energy resources.