Signing every new commit goes through 1Password, which prompts constantly during rebases and is unreachable from sandboxed agents; sign-on-push still signs everything that leaves the machine.