Is this backward compatible with clients that do not support SSH signing yet or older versions of git?
i.e What happens if I push a SSH signed commit to a Gitlab or Bitbucket remote or mirror the repository? How do the commits appear to a client that does not understand SSH signatures?
In any fast paced business, APIs constantly change. Versioning is not straightforward. Often corners are cut, and deadlines have to be met. There just is one version of the API, the one in production!
In my experience the most pain around GraphQL was due to a lack of care/time. Too often schemas are not strictly defined, are too generic (type: any) and fields are not documented. Errors are poorly defined etc. Combine that with untyped code, it's almost the same as sending blobs of arbitrary JSON around. In the short term it works, the feature is live, business is happy. But takes double the effort to untangle the code when you need to change something....
GraphQL also requires effort to make tooling and monitoring work well with it as it deviates from a traditional REST like model.
i.e What happens if I push a SSH signed commit to a Gitlab or Bitbucket remote or mirror the repository? How do the commits appear to a client that does not understand SSH signatures?