keyring

However, the keyring is one file (i.e., all the stuff is rolled together).

Otherwise the password is stored in your keyring (e.g.

Your operating system might have a keyring service or an encrypted filesystem you can use to store your keys in.

Sadly the kernel keyring option is looking like a better one than both of these.

Using getpid/gettid (or the keyring trick) you are doing a syscall for every check.

It has some weird problems like forcing gnome-keyring-daemon to run which breaks ssh-agent.

Then there's the practical concern that most gpg implementations are going to, by default, lookup in the keyring based on the To: address in the email and the user-ids of the keys in the keyring.

So to avoid problems, have only the minimum on your keyring.

You are right, a lot of the keys I have in my public keyring are actually 1024D/<whatever>g, made many years ago.

I don't mind having multiple cards in my wallet or keys on my keyring.

In the absence of keyring/keychain/etc., it'd be trivial to introduce a masterpassword implementation in the browser client which is XOR'd with secret credentials and stored as such.

If you leave a small pocketknife on your keyring, or you forget to put your cologne in the plastic bag, the seize it and throw it away.

It loads, shows the secret key as valid in the GPG Keyring app, but any attempt to decrypt a message fails with “Secret key to decrypt the message is missing”.

This is an interesting idea, but every time I see these sorts of "reduce the number of items in your wallet, passwords in your brainbank, and keys on your keyring" products my knee-jerk reaction is, "okay, so now all an identity thief has to do is take my one item/password/key and they have access to my everything?"

It's an artifact of the assumption that a proper base credential will be available from either libsecret, Gnome Keyring, or KDE Wallet.

That's why Chrome and most browsers prefer the system credential managers when available (on Linux: libsecret, Gnome Keyring, or KWallet).