One git life hack I adopted is to sign my commits with an SSH key that is stored in 1Password. Anytime a tool like git or vs code (with git under the hood) wants to sign commits, fetch/pull/push a remote, or clone a repo I get a nice pop up from 1P which prompts for TouchID on my macbook. My SSH keys don't not live on my machine as a result. This also works with SSH agent forwarding if you develop inside a VM or remote machine.
For the benefit of others that read this and like the idea, here are instructions: https://developer.1password.com/docs/ssh/git-commit-signing/