CONTRIBUTING: Add blurb about requiring signed commits (#98)

We require signed commits as of yesterday, and it'd be nice to have this
in writing somewhere to avoid contributors getting blindsided when
github has a scary x on the merge button.

Author: dcantah

CONTRIBUTING.md

@@ -24,6 +24,8 @@ To file a bug or feature request, use [GitHub issues](https://github.com/apple/c
 
 ### Pull Requests
 
+We require all commits be signed with any of GitHub's supported methods, such as GPG or SSH. Information on how to set this up can be found on [GitHub's docs](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#about-commit-signature-verification).
+
 To make a pull request, use [GitHub](https://github.com/apple/containerization/compare). Please give the team a few days to review but it's ok to check in on occasion. We appreciate your contribution!
 
 > [!IMPORTANT]