{osConfig, ...}: {
  assertions = [
    {
      assertion = !osConfig.services.gnupg.agent.enable;
      message = ''
        It is not recommended to enable both `homeConfig.services.ssh-agent.enable` and `osConfig.services.gnupg.agent.enable`!
      '';
    }
  ];

  # enable OpenSSH private key agent
  services.ssh-agent.enable = true;

  # WARNING: the ssh-agent won't set this for itself...
  systemd.user.sessionVariables.SSH_AUTH_SOCK = "$XDG_RUNTIME_DIR/ssh-agent";
}