#!/usr/bin/env zsh
# Sign files with SSH

setopt LOCAL_OPTIONS ERR_RETURN NO_UNSET PIPE_FAIL

autoload -U die
[[ ${ARGC} -eq 0 ]] && die 1 "Usage: ${0} [-f KEYFILE] [-n NAMESPACE] <file> …"

zmodload zsh/zutil
local -a keyfile=(-f ~/.ssh/id_ed25519)
local -a namespace=(-n file)
zparseopts -D -K -- f:=keyfile n:=namespace

ssh-keygen -Y sign -f ${keyfile[2]} -n ${namespace[2]} ${@}