SSH server accepts key, but signing fails

Question

I have recently tried migrating from a standard ssh public key setup to managing my keys with GPG. Following instructions on my distribution's wiki, I set up ssh to use gpg-agent instead of the default ssh-agent. I am quite certain that went fine: even with my ~/.ssh directory removed, ssh-add -l shows the one key I set up for it in gpg.

After that, I set the contents of my remote's ~/.ssh/authorized_keys to exactly the output of local ssh-add -L and restarted the daemon.

Now trying to connect to my remote using ssh -v <myremote>, I get the following error:

...
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: (none) RSA SHA256:<myfingerprint> agent
debug1: Server accepts key: (none) RSA SHA256:<myfingerprint> agent
sign_and_send_pubkey: signing failed: agent refused operation
debug1: Trying private key: /home/zoickx/.ssh/id_rsa
debug1: Trying private key: /home/zoickx/.ssh/id_dsa
debug1: Trying private key: /home/zoickx/.ssh/id_ecdsa
debug1: Trying private key: /home/zoickx/.ssh/id_ed25519
debug1: Trying private key: /home/zoickx/.ssh/id_xmss
debug1: No more authentication methods to try.
<myremote>: Permission denied (publickey).

Clearly, server agrees that my public key is authorized, but, for a reason that's unclear to me, refuses to continue.

The common answers if googling "sign_and_send_pubkey: signing failed" are to use ssh-add to add the missing private key or to change the permissions on keyfiles. Neither of these seem to be helpful in my case, using gpg-agent. My key does seem to be available to ssh, and there are no files to change permissions of.

A couple of things I am worried about:

• I do not get prompted for gpg's pinentry at any point
• The public key has the form ssh-rsa <key> (none), ending with the strange "none" instead of the standard user@host.

Additional information about my setup:

• gpg 2.2.15
• libgcrypt 1.8.4
• Output of gpgconf:

gpg:OpenPGP:/usr/bin/gpg
gpg-agent:Private Keys:/usr/bin/gpg-agent
scdaemon:Smartcards:/usr/lib/gnupg/scdaemon
gpgsm:S/MIME:/usr/bin/gpgsm
dirmngr:Network:/usr/bin/dirmngr
pinentry:Passphrase Entry:/usr/bin/pinentry

• gpg functions as expected for encryption/decryption, with pinentry working
• Not running Gnome or any other desktop environment - using dwm
• seahorse is installed

Answer 1

Since you're not being prompted to enter your GPG passphrase, the problem may be that the running gpg-agent cannot access the display/terminal. I encountered the same symptoms on Mac OS 10.14 (Mojave) with GPG version 2.2.17.

I found a workaround in the man page for gpg-agent:

Note: in case the gpg-agent receives a signature request, the user might need to be prompted for a passphrase, which is necessary for decrypting the stored key. Since the ssh-agent protocol does not contain a mechanism for telling the agent on which display/terminal it is running, gpg-agent's ssh-support will use the TTY or X display where gpg-agent has been started. To switch this display to the current one, the following command may be used:

     gpg-connect-agent updatestartuptty /bye

While I have not found a permanent solution, this command works for me. It needs to be repeated after each restart.