@civodul @glyph @akkartik @khinsen Just ditch GitHub/Gitlab really.
Git proper with the gpg.ssh.allowedSignersFile configuration allows to use a file (relative to repository-root) for the list of authenticated keys, and it entirely allows offline use because said file contains the public keys.