Isn't it possible to fabricate the timestamps on commits and then push them up all at once? If you're planning on literally checking that the commits are publicly available for a certain amount of time, that seems like it would needlessly punish projects that someone worked on offline and then happened to push up once it was completed.