To check the current gpg4win download (after having installed it as portable app already) I clicked on the separate signature file.
Kleopatra opened and told me the signing key could not be found.
So I selected to find it (with success) and to import it.
Next question was whether to sign it.
As my key had expired in the meantime, Kleopatra suggested to create a new one (instead of renewing the old one), so I did that, too.
Finally I signed WK's key using the newly created key, and the dialogue closed.
However WK's key still appeared untrusted (unsigned) even after trying to refresh the certificates.
So I tried to sign it again, but still nothing changed.
After some time I noticed the fan speeding up, and in the task manager Kleopatra was shown with high CPU usage.
Next I decided to use "Restart background processes", but that also didn't change a thing.
Eventually I stopped Kleopatra and restarted it (and the fan spun down).
Now the certificate is shown as signed.
In the Windows event log I found (it may be related to my restart attempts, or maybe not):
Name der fehlerhaften Anwendung: kleopatra.exe, Version: 3.3.0.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: libstdc++-6.dll, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0x40000015
Fehleroffset: 0x000ed884
ID des fehlerhaften Prozesses: 0x4dbc
Startzeit der fehlerhaften Anwendung: 0x01dbdaa90d679608
Pfad der fehlerhaften Anwendung: C:\Users\uwi\AppData\Local\Programs\Gpg4win\bin\kleopatra.exe
I now that this use scenario is quite untypical, but anyway...