i'm mcfuckin losing it

why does signing with one key work but not the other. the setups are identical

both systems have the same exact git and jj configs, deployed with home-manager. both keys are provided by Secretive and are both ecdsa-sha2-nistp256 keys with identical settings. both are verified on forgejo. one shows up as verified, the other doesn't
there's a suspiciously similar issue, but they don't particularly elaborate on how to fix this. the email address on both keys is identical
it's also reproducible with plain git, so ignore the jj part pls
here's a valid signature with the other attached key. so it's not an issue with git, jj, ecdsa-sha2-nistp256, the email address, or secretive. this is supremely confusing
@Agatha the commit objects also have the same email? Forgejo loves to display different account / git author / git committer details in different places of the UI