> people putting their passphrase into the commit message.

Ummmm... How exactly? The commit message isn't prompted if
you are using repoman. You get one prompt _before_ your
passphrase comes up. If you're doing that, then you really
need to slow down.

If you _DO_ manage to do this, be sure to invalidate your
keys and pass the new fingerprint onto devrel.

If there is an issue here that you feel can be resolved by
a different kind of prompt, please let dev-portage know via
a bug and we can get on it.

--NJ