- alone is not verification. If verification fails, stop and report it.
- Do not claim completion or publish the commit.
+ alone is not verification. If `gpg.ssh.allowedSignersFile` is not
+ set, use a temporary allowed-signers file with the configured key. Do
+ not change the Git configuration. If verification fails, stop and
+ report it. Do not claim completion or publish the commit.