Jeff King [off-list ref] writes:
However, I wonder if it is really ever going to be sane to set
commit.gpgsign and not use something like gpg-agent.
For example, if you
were to ever "git rebase" a patch series (or even just use "git rebase
-i" to refactor commits), you would be prompted for your passphrase to
sign each individual patch.
Correct.
I actually doubt it is sane to set commit.gpgsign to true and trust
gpg-agent, but that is a separate issue.