-4. Write the message to a file or a here-document and sign the commit
- with the configured key, using `git commit -S -F`. Never put `\n` in
- `git commit -m`.
-5. When `.githooks/commit-msg` rejects the message, fix the message and
- commit again. Do not skip the hook with `--no-verify`.
-6. Cryptographically verify each new commit's signature against the
- configured key before reporting completion. A signature header alone
- is not verification. If verification fails, stop and report it. Do
- not claim completion or publish the commit.
+4. Write the complete message to a file, including all trailers. Add
+ trailers with `git interpret-trailers --trailer` before the check,
+ not after it. Never put `\n` in `git commit -m`.
+5. Run `sh .githooks/commit-msg MESSAGE_FILE` on that final file before
+ `git commit`. Fix every failure and run the check again. Sign with
+ the configured key, using `git commit -S -F MESSAGE_FILE` on the same
+ file. Do not add or change trailers after the check. The normal
+ commit hook still runs. Never skip it with `--no-verify`.
+6. Cryptographically verify each new normal commit's signature against
+ the configured key before reporting completion. A signature header
+ alone is not verification. If `gpg.ssh.allowedSignersFile` is not
+ set, use a temporary allowed-signers file with the configured key. Do
+ not change the Git configuration. If verification fails, stop and
+ report it. Do not claim completion or publish the commit.