Is this backward compatible with clients that do not support SSH signing yet or older versions of git?
i.e What happens if I push a SSH signed commit to a Gitlab or Bitbucket remote or mirror the repository? How do the commits appear to a client that does not understand SSH signatures?
It's just ignored. The signing data is added in the same way as a GPG key, just in a different format. Git commands don't look at signatures by default, and if they do, they will just say "invalid signing format" or some such.
It's always possible some program handles this badly, but I've been signing with ssh pretty much since the day it was added to git (before it was in a release) and never experienced any problems or complaints.
In any fast paced business, APIs constantly change. Versioning is not straightforward. Often corners are cut, and deadlines have to be met. There just is one version of the API, the one in production!
In my experience the most pain around GraphQL was due to a lack of care/time. Too often schemas are not strictly defined, are too generic (type: any) and fields are not documented. Errors are poorly defined etc. Combine that with untyped code, it's almost the same as sending blobs of arbitrary JSON around. In the short term it works, the feature is live, business is happy. But takes double the effort to untangle the code when you need to change something....
GraphQL also requires effort to make tooling and monitoring work well with it as it deviates from a traditional REST like model.
That is exactly why I no longer use Firefox. I moved to germany and I don't speak german, so you can imagine browsing without this functionality is impossible.
i.e What happens if I push a SSH signed commit to a Gitlab or Bitbucket remote or mirror the repository? How do the commits appear to a client that does not understand SSH signatures?