It doesn't look like we enforce a DCO requirement. We probably should if we're going to accept external contributions.