A developer has created a robust system using symlinks and SSH agent forwarding to ensure Git commits remain hardware-signed via Secure Enclave even when working remotely.

Key Points

• The setup uses Secretive to store SSH keys in the Apple Secure Enclave, ensuring private keys never exist as files on disk.
• A custom symlink, ~/.ssh/agent.sock, dynamically switches between the local machine's agent and a forwarded remote agent.
• Git is configured with gpg.ssh.defaultKeyCommand to resolve the correct signing key at the moment of execution rather than using a static configuration.
• Shell hooks and a LaunchAgent ensure that GUI applications and long-lived processes, such as Claude Code, maintain access to the active agent socket.
• The system supports multi-device workflows, allowing commits from an iPad or secondary laptop to be verified by GitHub using device-specific keys.

Why it Matters

This configuration solves the common security trade-off between using hardware-backed keys and maintaining a flexible, remote-first development workflow. By automating agent management, developers can maintain high-security standards without sacrificing the ability to sign commits from any device they control.