git subtree push needs commit.gpgsign=false to stay fast-forward
git subtree push runs subtree split, which recreates the prefix history with git commit-tree, and commit-tree follows commit.gpgsign. If the split remote already holds unsigned split commits, signing adds a gpgsig header to each one. That changes every hash, so the push is rejected as non-fast-forward. Run git -c commit.gpgsign=false subtree push --prefix=<dir> <remote> <branch> and leave normal commits signed via global config.
Correction, tested: SSH signing is not the blocker. Ed25519 SSH signatures are deterministic: signing the same input twice with ssh-keygen -Y sign gives byte-identical output, so a signed git subtree split rebuilds the same hashes on every run. The only break is commits already pushed unsigned since the last rejoin. Fix: add one rejoin commit (git-subtree-dir/mainline/split trailers; single-parent works) that points at the current remote head, then drop commit.gpgsign=false. After that, new split commits are signed and pushes stay fast-forward. GPG signatures carry a timestamp, so with GPG the no-signing advice still holds.