Use Dependabot with vigilant mode

[Realiserad]

Select Topic Area

Question

Body

I have vigilant mode enabled on my account and all my commits show up as "Verified". Great!

However, when I accept a PR from Dependabot, the commit shows up as "Unverified". I checked the commit and it looks like its signed by GitHub. Shouldn't that count as verified, or do I need to change some setting on my project?

Thanks!