Make it easier to audit and trust SpaceVim when syncing to multiple machines
**Is your feature request related to a problem? Please describe.**
A text editor is a tool one needs to trust to a pretty high degree. There are many people who use it to keep notes, write software, manage TODOs and so on. [Supply chain attack](https://en.wikipedia.org/wiki/Supply_chain_attack) are getting more common unfortunately.

Also, people commonly use their editor with their configuration and plugins on more than one device (think personal and work machine). A way to sync the config (git and dotfiles managers) is often used.

This raises to generic question: How to audit/verify SpaceVim and then include it in once dotfile repo so that one can be sure to use the exact same config and plugin code on all machines?

I am still checking out SpaceVim but I have identified two issues:

* https://github.com/SpaceVim/SpaceVim/tree/master/bundle seems to be a "git subtree" like workflow. It is not sure from which exact commit this "fork" (as you call it) was done. Nor is there a way to verify that the code matches the upstream version exactly. How do you deal with pulling in patches from upstream btw? No offense but this looks like a messy solution.
* Additional plugins (via layers for example) get installed in `~/.cache/vimfiles/repos`, probably just using their git master branch. So this could be different on every machine.

**Describe the solution you'd like**

- [ ] Use git submodules for https://github.com/SpaceVim/SpaceVim/tree/master/bundle. This makes it clear that you did not mess with the plugin. If changes don’t get merged, you could temporarily fork the repo under https://github.com/SpaceVim and point to that one. I guess you went with this "git subtree" like workflow for performance reasons. Git submodules also supports `--depth 1` cloning. You can test with my repo:
   ```Shell
   time git clone --recursive --depth 1 --shallow-submodules --jobs 8 'https://github.com/ypid/dotfiles.git'
   ```
   It took 3 minutes.
   Refs: https://github.com/Shougo/dein.vim/issues/353
- [ ] Consider releasing the full `~/.SpaceVim` git repo as .tar.gz which will speed up install time. It is still possible to verify using git locally after unpacking the archive.
- [ ] Come up with a way to "hash lock"* repos installed under `~/.cache/vimfiles/repos`. I would go with git submodule also for this. Basically point `~/.cache/vimfiles/repos` into once dotfiles repo and then use `git submodule add` instead of `git clone`. This should be off by default.
- [x] Use OpenPGP to sign your commits and git tags/releases. The last part is something only the maintainers of SpaceVim can implement.

**Describe alternatives you've considered**

Just continue using my own Vim dotfiles where I have implemented all those requirements already. Ref: https://github.com/ypid/dotfiles/tree/rework/nvim

**Additional context**
I am a Qubes OS user and have high security requirements. So for example, I put limited trust in GitHub and assume it could respond with backdoored files to a `git pull` on one of my machines. Ref: https://www.qubes-os.org/faq/