This is why your ssh key should be on a yubi and you should have to touch it (confirm presence) to use it.

you dont even need anything special anymore to do this just ssh-keygen -t whatever-sk and the magic happens.

same key can sign commits...