If the keys on the smart card are already known to Kleopatra/GnuPG (which should be the case if the smart card was inserted when Kleopatra was started), then on import of the corresponding public key Kleopatra now asks whether the certificate is the user's certificate (instead of asking whether they want to certify it).

Thanks for reporting. We usually test by moving the <keygrip>.key files around ;-)

For this I think a better solution might be if we would remove keys that are already in a group from the list of "available" keys.
By this I mean that if you edit a group and move keys down then they should be removed from the upper list of available keys so that it is easily visible which keys in your keyring are not part of a specific group.

done

works

very nice

This is now ready for testing. The import result dialog and the import error dialog now have an additional "Show Audit Log" button.

works

Actually we should switch from putenv to SetEnvironmentVariable et al. because that avoids problems wit different Windows libc versions, for example in DLLs.

Fixed in rG8e8971403f75: w32: Fix gnupg_unsetenv..

Sure, but this will need adaption in FIPS mode as it fails with:

Patch using SHA1 instead of MD5.

There are other uses of MD5 and thus we can't disable it. For example gpgsm also lists the MD5 fingerprint of certificates because they are still in use at some places.