I forgot: Instead of importing the missing internal CA, this works:

I agree, the question is which CRL is checked when how. Maybe there is some mistake on my side. Here is a recipe for Debian:

Many thanks for the fast fix! Decryption works now. I'll report another bug for encryption.

A quick note: The second workaround above does not work.
The presence or absence of the expired certificate in my keyring does not matter. The check by dirmngr fails regardless.

On 2016-07-19, Justus Winter via BTS wrote:

Hi Bernhard,

If I create a key as follows, no expiry date is set:
$ gpg2 --faked-system-time 20100101T000000 --default-cert-expire 1y
--quick-gen-key 'Test Key <test@example.org>'

If I edit a key to add a new user ID under a faked system time as follows, the
new user ID does not receive the specified expiry date.
$ faketime 2010-01-01 gpg2 --homedir test --edit-key --default-sig-expire 2013-12-31