attach: say up front which signed commits keep their signature

The confirmation still said every signed commit loses its signature. It now says the user's own signed commits are signed again with their key, and lists the signed commits someone else committed, which still lose theirs. The committer check and the user's email lookup are shared with the rewrite, so the warning and what the rewrite does can't disagree on whose commit it is.