How should submodules use different sshCommand during initial update?

[Shibo Xia <sbxia25@gmail.com>]

Hi,

I have a question about submodules and SSH authentication during the initial
git submodule update --init step.

I understand that there are already a few ways to influence SSH behavior:

core.sshCommand at the repository level

GIT_SSH_COMMAND at the command level

SSH host aliases and other settings in ~/.ssh/config

However, I am running into a more specific problem with submodules.

My use case is that different submodules may need different SSH identities or
different SSH command settings. For an already initialized submodule, this can
be handled by entering the submodule repository and configuring it separately.
But during the initial git submodule update --init, the submodule does not yet
have its own local config, so there does not seem to be a clean per-submodule
way to do this from Git itself.

In practice, the usual workaround seems to be putting the logic into SSH
configuration and encoding it through host aliases or URL layout. That works,
but it also means the authentication behavior is kept outside Git's submodule
configuration, even though the submodule remote itself is already configured in
Git.

So my questions are:

Is there already a recommended Git-native way to handle different
sshCommand values for different submodules during initial clone/update?

If not, would support for something like a per-submodule sshCommand
configuration be considered reasonable?

Has this been discussed before specifically in the context of submodule
initialization, rather than per-remote SSH options in general?

I am not sending a patch yet. I first wanted to ask whether this is considered
a real gap in current submodule behavior, or whether the expectation is that SSH
configuration should remain the only solution here.

Best regards,
Shibo Xia