diff --git a/modules/keys/allowed-signers.nix b/modules/keys/allowed-signers.nix
index 326b110..c197a75 100644
--- a/modules/keys/allowed-signers.nix
+++ b/modules/keys/allowed-signers.nix
@@ -1,9 +1,12 @@
-# Signature-verification principals, fleet-wide. Builds the lines every
-# allowed-signers file is generated from: each registered signing key
-# (signing.nix) verifies under Graham's identities, and agent keys
-# additionally verify under that agent's DID. Register a DID here when
-# an agent starts committing as it; the agent's drop-in references this
-# map for its committer identity, so this file is the single source.
+# Signature-verification principals, fleet-wide: the single source the
+# allowed-signers files are generated from. Each key maps to its
+# OWNER's identities only — git reports the first principal matching a
+# key (the committer identity plays no part in ssh verification), so a
+# key listed under someone else's identity attributes their commits to
+# the wrong party. Host keys are Graham's (email + DID); an agent key
+# maps to the agent's DID once registered here, else to the shared
+# email the agent commits under. The agent's drop-in references this
+# map for its committer identity.
 let
   keys = import ./signing.nix;
 
@@ -11,15 +14,22 @@ let
     "puregarlic@users.noreply.github.com"
     "did:plc:57od6g2ic3e3b3kauctjmo3k"
   ];
-in
-rec {
-  # <key name in signing.nix> -> that agent's DID
+
+  isAgentKey = kn: builtins.match ".+-.+" kn != null;
+
+  principalsFor = kn:
+    if agentDids ? ${kn} then [ agentDids.${kn} ]
+    else if isAgentKey kn then [ "puregarlic@users.noreply.github.com" ]
+    else grahamIds;
+
   agentDids = {
     brume-hollis = "did:plc:aqicwyouvv65bm5vpmvcodui";
   };
+in
+{
+  inherit agentDids;
 
   lines = builtins.concatLists (map
-    (kn: map (p: "${p} ${keys.${kn}}")
-      (grahamIds ++ (if agentDids ? ${kn} then [ agentDids.${kn} ] else [ ])))
+    (kn: map (p: "${p} ${keys.${kn}}") (principalsFor kn))
     (builtins.attrNames keys));
 }