With keyboxd now more ready for prime time we want users to try it out. The way to try it out will be to export all their certificates using Kleopatra and then reimporting them after switching to keyboxd.

For X509 this does not work well on reasonably dirty keyrings because it will both try to fetch missing issuer certificates and CRLs and run into a ton of dirmngr timeouts. On my Linux system the difference is 48 minutes to import my 800 S/MIME certificates. While it takes 1.6 seconds with --disable-dirmngr.

While it might be nice to have the CRL check / issuer certificate check done when importing only a one certificate i think it should be offline at first. This is anyway more in line with what kleopatra would show when the keyring was already imported because the initial keylisting would be offline.

Optionally If we then see in the import results that only, say less then 5 certificates were imported then we could maybe do a keylist with validation / crl checks on them right after import?