I would hope that any software I use, that is able to put my digital
signature on some data, would ask me for my pass-phrase every time
my private key is used.
and I would hope that any software I used would not offer to execute
content that could have harmful side effects, without first warning
me in very clear language that this could happen.
software in the real world rarely does all that is hoped for.
Keith