DCO app does not verify that Signed-off-by email address matches the commit author's email address

[myitcv]

Gerrit enforces this, and indeed it would seem to be a basic requirement that the two match.

Note that Gerrit does not enforce that the names match, just the email address.