[PATCH] doc: gpg: say which date SSH key lifetimes are checked against

["Christian Noé Ramos López" <chris@nortesoftware.dev>]

The description of gpg.ssh.allowedSignersFile says that Git marks a
signature as valid if the signing key was valid at the time of the
signature's creation. An SSH signature does not record when it was
made, though. When verifying a commit or a tag, Git passes the
committer or tagger date to ssh-keygen with -Overify-time, so the
valid-after and valid-before options of a key are checked against a
date that whoever creates the commit or tag can set to any value.

Say which date is used, and that it is not evidence of when the
signature was made. The same holds for the creation time in a GPG
signature, which comes from the signer's clock, so say that too.
Since whoever holds the key chooses the date, also say that a key
lifetime is only safe as long as the key has never leaked.

While at it, fix the spelling of "OpenSSH" in the same paragraph.

Helped-by: Phillip Wood <phillip.wood@dunelm.org.uk>
Helped-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Christian Noé Ramos López <chris@nortesoftware.dev>
---
 Documentation/config/gpg.adoc | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/Documentation/config/gpg.adoc b/Documentation/config/gpg.adoc
index 240e46c05..714dd1457 100644
--- a/Documentation/config/gpg.adoc
+++ b/Documentation/config/gpg.adoc
@@ -70,10 +70,15 @@ A repository that only allows signed commits can store the file
 in the repository itself using a path relative to the top-level of the working tree.
 This way only committers with an already valid key can add or change keys in the keyring.
 +
-Since OpensSSH 8.8 this file allows specifying a key lifetime using valid-after &
-valid-before options. Git will mark signatures as valid if the signing key was
-valid at the time of the signature's creation. This allows users to change a
-signing key without invalidating all previously made signatures.
+Since OpenSSH 8.8 this file allows specifying a key lifetime using valid-after &
+valid-before options. When verifying a commit or a tag, Git checks that lifetime
+against the committer or tagger date recorded in the commit or tag. This allows
+users to change a signing key without invalidating all previously made
+signatures. That date is chosen by whoever creates the commit or tag, so it is
+not evidence of when the signature was made; the same is true of the creation
+time in a GPG signature, which is set by the signer's clock. Relying on a key
+lifetime is therefore only safe as long as the signing key has never leaked;
+once it has, valid-after and valid-before guarantee nothing.
 +
 Using a SSH CA key with the cert-authority option
 (see ssh-keygen(1) "CERTIFICATES") is also valid.

base-commit: 47fdf2208c5b94c8cc01c106b8f7c85efb91c926
-- 
2.47.3