@abcdw, IMHO all mainline commits should be signed by a maintainer (it's at least enforced via guix authenticate) so if a device is capable of git+PGP there should be no reason there can't be some git+mbox tool to take care of the patch application part.