I'd like to keep my keys secure, but also not have to enter a passphrase on every single git invocation, when I want to run several commands in quick succession. I've researched this, and found that ssh-agent/keychain/etc. go too far convenience-vs-security-wise to my liking. Something like xyz git pull would be perfect, where xyz checks if my key is decrypted, and if it isn't - asks for my passphrase, and then after N minutes of not invoking xyz it forgets the decrypted value. Exactly like sudo. Does this exist / can this be achieved through some tricky means?There's a similar question about this, but our use cases differ.
Sudo-like utility for ssh, or at least git in particular?
ssh;git;ssh agent
This is exactly what ssh-agent does.where xyz checks if my key is decrypted, and if it isn't - asks for my passphraseYou don't need any xyz. Just start ssh-agent at the start of your session (for example in ~/.bashrc):[ -z $SSH_AUTH_SOCK ] && eval $(ssh-agent -t 5m)And configure your ssh client to add the keys when they are first used by settingAddKeysToAgent yesin your ~/.ssh/config.and then after N minutes of not invoking xyz it forgets the decrypted value.This is what the -t switch of the ssh-agent does. Sets default timeout for added keys (in the example above 5 minutes).