[tomyws]

I only recently discovered the local "current repository" configuration option, but I still need to verify which identity I'm using before a commit.

It makes sense not to set the global config at all if you're paranoid. This ensures you have to setup the user.name and user.email locally.

[sigsergv]

There is also extremely useful option user.useConfigOnly, it was added recently though. Before 2.8 (iirc) you had to use weird hack "git config --global user.email '(none)'"