a: expired certificate
Dialog text:
The signature is invalid: The signing certificate has expired.

After further discussion, I propose the following. All tool tips and the last dialog text were changed:

I have not tested this extensively but it seems to me after some fast checks that the pivotal point here is the usage of a brainpool key on a smart card for the decryption.

I have not tested this extensively but it seems to me after some fast checks that the pivotal point here is the usage of a brainpool key on a smart card for the decryption.

tested with Gpg4win 5.0Beta-336

Likely connected to T7705: Okular: Error on signature if the original file is overwritten

I can confirm this.

Edit 2025-06-26:
And please Fix the ALT shortcut in the "Sign / Encrypt", "Sign" and "Encrypt" button to S or E, respectively. One can hardly see the mark at the "i" and its unintuitive, anyway:

Staring at some Process Monitor logs I noticed that dirmngr wastes 3-4 seconds trying to connect to localhost:9050 and localhost:9150 looking for tor. After adding no-use-tor to dirmngr.conf dirmngr starts reasonably fast.

In T7379#195089, @ikloecker wrote:

Kleopatra does now read the certificates from the card and import them itself instead of relying on gpgsm --learn-card.

Remove the lines starting with ShowResultsAfter[...] in kleopatrarc

I have built the run-* test programs of gpgme for Windows. run-keylist --cms --secret takes about 23 seconds. 3.7 seconds are gpgme initialization/setup (gpgconf --list-dirs, gpgconf --list-components, gpg --version, gpgsm --version, gpgconf --version). Most time (2 x 6-8 s) is lost starting gpg-agent and dirmngr. (keyboxd is not enabled here.)