GnuPG agent forwarding is the coolest thing I didn't realise I knew I wanted (until I tried to sign a commit in a VM) https://wiki.gnupg.org/AgentForwarding
I was thinking about messing with USB passthrough (for GPG smartcard), too, so I'm lucky I looked for this first.
"I appreciate SDF but it's a general-purpose server and the name doesn't make it obvious that it's about art." - Eugen Rochko