This is opt-out dark pattern territory. Git commits are a permanent record of authorship silently injecting a co-author trailer without explicit consent is a trust violation, regardless of intent.
WebRTC DataChannels work well for this. Chunk the file (~64KB chunks), handle backpressure manually, and use a simple signaling server for the handshake. wormhole.app is a good reference implementation.