I have two keys for my principal user ID: an old one, and a longer one I generated more recently. I no longer use the old one. I set the default key to the newer one using the default-key
option in ~/.gnupg/gpg.conf
.
However, some tools override the default setting, for example calling git tag -s
, which calls gpg -bsau DEFAULT_COMMITTER_EMAIL_ADDRESS
under the hood. (This is sensible, because my default committer email address may not match my principal user ID for gpg.) This seems to make GnuPG use the first key it finds that matches the user id, typically the oldest.
I can fix this in my git configuration by setting a default key there too, but I'd rather not have this duplicate setting (because in my case, all the identities are the same).
I managed to work around it by removing the older keys from my keyring, then re-adding them (which seems to add them at the end). Then, my newest (preferred, default) key comes out first in gpg --list-secret-keys
, and hence it is the first match returned for my user ID.
Is there any way to avoid this workaround (which I'd have to redo each time I generate a new key)?