I know tptacek regards this as a security antipattern (he's usually right), but I do it anyway for smaller projects. It's better than committing plaintext secre

I know tptacek regards this as a security antipattern (he's usually right), but I do it anyway for smaller projects. It's better than committing plaintext secrets to a repo somewhere. Couple things I wonder about: 1. I don't understand why git-crypt is written in C, when a shorter shell script that calls out to openssl(1) and gpg(1) would seem to suffice. 2. The symmetric key mode isn't ideal -- the gpg mode is better -- but up until OpenSSH 6.7 you couldn't easily forward gpg-agent's unix domain socket, which you need for working with a git checkout on a remote machine. There are also some issues with the gpg-agent protocol last I checked. Has anyone actually gotten gpg-agent forwarding to work?