I'm learning fossil and trying to reproduce a workflow for two people modifying the same source code tree.

So, Alice and Bob both have local repositories of some source code. Both have autosync off. Alice hacks some more, does some commits signing check-ins with her gpg key. This part is fine, as Alice I've managed to generate gpg keys, fossil asked me the key password when commiting. I'm also aware of gpg-agent but don't use it yet, because I'm trying to keep things as simple as possible for now.

Now, at some point Bob pulls changes from Alice's fossil repo. How would he verify Alice's signed check-ins?