{ ... }:

{
  # Limits which keys the 1Password SSH agent offers. Without this file the
  # agent exposes every SSH key in every vault, and servers drop the connection
  # after ~6 failed offers before reaching the right one. Order is the order
  # the agent offers them in, so the default key goes first.
  #
  # Git commit signing also runs through this agent: op-ssh-sign asks it for
  # signing.key from git.nix (SHA256:bJijYfOAsuLQBTfz9P8ncrp0Uft3+wyRov4a8VqcVkE).
  # Dropping the item that holds that key breaks signing, silently until the
  # next commit. Verify with `ssh-add -l` after changing this list.
  home.file.".config/1Password/ssh/agent.toml".text = ''
    [[ssh-keys]]
    item = "Default"

    [[ssh-keys]]
    item = "jp-gitlab"

    # Git commit signing (git.nix signing.key)
    [[ssh-keys]]
    item = "Signing Key"
  '';
}