-6. Cryptographically verify each new commit's signature against the
- configured key before reporting completion. A signature header alone
- is not verification. If verification fails, stop and report it. Do
- not claim completion or publish the commit.
+6. Cryptographically verify each new normal commit's signature against
+ the configured key before reporting completion. A signature header
+ alone is not verification. If `gpg.ssh.allowedSignersFile` is not
+ set, use a temporary allowed-signers file with the configured key. Do
+ not change the Git configuration. If verification fails, stop and
+ report it. Do not claim completion or publish the commit.