Function write_allowed_signers 

pub fn write_allowed_signers(
    root: &Path,
    keys: &[TrustedKey],
) -> Result<PathBuf>

Writes <root>/.choir/allowed_signers — the file git’s ssh signature verification checks push certificates against. One line per actor: principal (the actor id) followed by the OpenSSH public key.

Errors

Propagates filesystem failures.