Line 2 (services side) used a bare key line, which the allowed_signers parser rejects; prefix it with the signer principal like line 1 so git verify-commit matches the key.
Line 2 (services side) used a bare key line, which the allowed_signers parser rejects; prefix it with the signer principal like line 1 so git verify-commit matches the key.