For the second case, I think that gcry_kdf_defive should not be called with pw="". The result of FAILURE gpg-exit 33554433 comes from the log_error after failure of gcry_kdf_derive.

After recompiling, it works!

I backported the work of Andre for qt6 to master/kf5. It's in the branch work/carl/product-name-kf5

Implemented in https://invent.kde.org/pim/kleopatra/-/merge_requests/290

The technical background is that opening the certificate details triggers an update of the certificate and this triggers an update of the drop-down. The drop-down should still keep the currently selected certificate even if it is not offered by default.

This is related to T6072: Kleopatra: Display "gpgconf -X"

The fix should probably be backported to gnupg 2.2 and 2.4.

The only thing that's a bit ugly is that there's no checkbox in front of "Encrypt for others" because it's mostly superfluous/redundant to the presence or absence of "other" certificates.

I'm wondering if/how we can get rid of the checkbox before "Encrypt for me". Do we even need to distinguish between "for me" and "for others"? It has always felt wrong to me that we have completely different UI for selecting my single (!) key and multiple other keys. What if I want to encrypt to two keys of me? Makes no sense to enter my second key under "Encrypt for others". What if somebody always wants to encrypt everything to two of their keys, e.g. because they use different keys on different devices? But that also applies to the file encryption dialog so maybe that's a different discussion.

In T5957#192598, @ebo wrote:

But what I don't understand is: why do we need the buttons? For other encryption actions in Kleo you can choose from all available keys, regardless of their protocol.

I confirm the fix. Using gnupg master the unit test ran 544 times without any failures or suspiciously long run time.