Does it make sense to start privately and then open the repo after publication? Will the dates be retained? Also, isn't commit history easy to spoof?