What should '--local-user' mean when multiple secret keys match?

[Dashamir Hoxha]

On Thu, Jan 31, 2019 at 11:33 PM Daniel Kahn Gillmor <dkg at fifthhorseman.net>
wrote:

>
> > From my experience (and meditation) I have arrived in the conclusion
> > that usually it is better to keep only one secret key per context (or
> > GNUPGHOME), and to change the context whenever you need to use a
> > different key.
>
> This is a super interesting observation.  Do other people have the same
> experience?  it seems to me that keeping the public keyrings in sync
> alone would be a fair amount of hassle.  Can you describe any other
> scenarios where that might improve the user experience?  I want to
> really focus on making it easy for even a non-technical user to do
> sensible things easily, in particular here: a planned, phased-in,
> non-sudden key transition.  Can you give other examples of where the
> separated secret keyring is concretely useful and usable?
>

Suppose that one wants to use a secret key to communicate with colleagues,
another one to communicate with friends, and another one to communicate
with his family. If he keeps all the secret keys and all the public keys on
the same addressbook (or keyring), it is possible that sometimes he may
make mistakes and use the wrong key for decryption and signatures. If they
are kept on separate contexts (or separate keyrings, or addressbooks) the
possibility of mistakes may be smaller.

In general, if you need to have more than one secret key (for any reason),
it seems to me more complicated, confusing and error-prone to keep them in
the same keyring than to keep them on separate keyrings (contexts).

Dashamir
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20190201/069b8db2/attachment.html>