Just downloaded the file and signature and there is only one signature. Just verifying the signature also does not result in duplicated results.

Thanks for the report. I'm only giving it low priority because while it is ugly it is no loss of functionality.

Without --expert my proposal for full-gen-key would be:

I think we can fix it by removing the smime attachment from OOM, because we still have it in MAPI, we just never cared that it was also in OOM (where only our decrypted attachments belong) because it was hidden.

This is generally the better tracker to report Gpg4win / Kleopatra issues. The git systems are linked in a way that I can both automatically add a commit here and in the KDE tracker.
I just noticed the KDE report a bit quicker because there is less traffic, but I would have seen it here within the day.

In T2300#90092, @aheinecke wrote:

Ah nevermind. I think myself that this is nobug and current behavior is correct.

To implement / test the "not literally RFC compliant but in practice better" behavior let us call this now a wish and feature request as there are certificates in the wild other then intevation's and customers in large institutions run into that.

In my debian buster pbuilder enviornment I got the following failure when packaging master (beta195):

Gpg4win-3.1.8 was released.