Refactor codebase so that GPG User PIN is cached if tested good (circumvent 'forcesig' security setting under Heads use case)

[tlaurion]

My nk3 was having non default setting;
gpg --card-status :
Signature PIN ....: not forced

Doing git rebase operations (and therefore signing commits individually) just doesn't make sense with USB Security dongle's protected private keys with Signature forced. Not sure if this toggle should be on actually, but out of scope of this PR.
Changing this for sake of testing.

gpg --card-edit

gpg/card> admin
Admin commands are allowed

gpg/card> forcesig

Seems like we come to a time where caching GPG User PIN is desired.
Originally posted by @tlaurion in #1935 (comment)