pkgmgr push --no-sign skips the re-sign rebase and the unsigned-range refusal, so a checkout without a usable signing key can still sync the fetch URL and every mirror pushurl. Leases and the git cherry guard still apply. push_branch takes sign as a required keyword; pkgmgr release and release --retry pass sign=True, so releases stay signed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>