SECTION 06 / SIGNATURES
Git signing
Use the same stable agent path for commit and tag signatures, whether the key is local or forwarded.
Configure Git for SSH signatures
git config --global gpg.format sshgit config --global user.signingkey ~/.ssh/id_ed25519.pubgit config --global commit.gpgsign trueGit invokes ssh-keygen, which consults SSH_AUTH_SOCK. When that variable points at Lanyard, the requested public key can be signed by a forwarded laptop agent or by the local fallback.
Verify a commit
git commit --allow-empty -m 'chore: verify signing'git log --show-signature -1Allowed signers
Verification is separate from signing. For local verification, configure Git’s gpg.ssh.allowedSignersFile with the identities you trust.
john@example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...NO KEY COPYINGThe public key selects a signer. The private key stays inside its original agent throughout.