diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3f3c05290..7c11976a2 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,247 +1,247 @@
 # SPDX-FileCopyrightText: none
 # SPDX-License-Identifier: BSD-3-Clause
 cmake_minimum_required(VERSION 3.16 FATAL_ERROR)
 
 set(RELEASE_SERVICE_VERSION_MAJOR "23")
 set(RELEASE_SERVICE_VERSION_MINOR "03")
 set(RELEASE_SERVICE_VERSION_MICRO "70")
 
 # The RELEASE_SERVICE_VERSION is used by Gpg4win to add the Gpg4win version
 if (NOT RELEASE_SERVICE_VERSION)
     set(RELEASE_SERVICE_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}.${RELEASE_SERVICE_VERSION_MINOR}.${RELEASE_SERVICE_VERSION_MICRO}")
 endif()
 if(RELEASE_SERVICE_VERSION_MICRO LESS 10)
     set(KDE_APPLICATIONS_COMPACT_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}${RELEASE_SERVICE_VERSION_MINOR}0${RELEASE_SERVICE_VERSION_MICRO}")
 else()
     set(KDE_APPLICATIONS_COMPACT_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}${RELEASE_SERVICE_VERSION_MINOR}${RELEASE_SERVICE_VERSION_MICRO}")
 endif()
 
 set(KLEOPATRA_VERSION_MAJOR "3")
 set(KLEOPATRA_VERSION_MINOR "1")
 set(KLEOPATRA_VERSION_MICRO "24")
 
 set(kleopatra_version "${KLEOPATRA_VERSION_MAJOR}.${KLEOPATRA_VERSION_MINOR}.${KLEOPATRA_VERSION_MICRO}.${KDE_APPLICATIONS_COMPACT_VERSION}")
 # The following is for Windows
 set(kleopatra_version_win "${KLEOPATRA_VERSION_MAJOR}.${KLEOPATRA_VERSION_MINOR}.${KLEOPATRA_VERSION_MICRO}")
 set(kleopatra_fileversion_win "${KLEOPATRA_VERSION_MAJOR},${KLEOPATRA_VERSION_MINOR},${KLEOPATRA_VERSION_MICRO},0")
 
 project(kleopatra VERSION ${kleopatra_version})
 
 option(DISABLE_KWATCHGNUPG "Don't build the kwatchgnupg tool [default=OFF]" OFF)
 
 # Standalone build. Find / include everything necessary.
 set(KF5_MIN_VERSION "5.100.0")
 set(KIDENTITYMANAGEMENT_VERSION "5.22.40")
 set(KMAILTRANSPORT_VERSION "5.22.40")
 set(KMIME_VERSION "5.22.40")
-set(LIBKLEO_VERSION "5.22.41")
+set(LIBKLEO_VERSION "5.22.42")
 set(QT_REQUIRED_VERSION "5.15.2")
 if (QT_MAJOR_VERSION STREQUAL "6")
     set(QT_REQUIRED_VERSION "6.4.0")
 endif()
 set(GPGME_REQUIRED_VERSION "1.16.0")
 
 if (WIN32)
   set(KF5_WANT_VERSION "5.70.0")
   set(KMIME_WANT_VERSION "5.12.0")
 else ()
   set(KF5_WANT_VERSION ${KF5_MIN_VERSION})
   set(KMIME_WANT_VERSION ${KMIME_VERSION})
 endif ()
 
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 find_package(ECM ${KF5_WANT_VERSION} CONFIG REQUIRED)
 set(CMAKE_MODULE_PATH ${ECM_MODULE_PATH})
 set(CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules ${CMAKE_MODULE_PATH})
 
 include(ECMInstallIcons)
 include(ECMSetupVersion)
 include(ECMAddTests)
 include(GenerateExportHeader)
 include(ECMGenerateHeaders)
 include(FeatureSummary)
 include(CheckFunctionExists)
 include(KDEInstallDirs)
 include(KDECMakeSettings)
 include(KDECompilerSettings NO_POLICY_SCOPE)
 include(ECMAddAppIcon)
 include(ECMQtDeclareLoggingCategory)
 include(ECMDeprecationSettings)
 include(KDEClangFormat)
 
 # Find KF5 packages
 find_package(KF5WidgetsAddons ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5ConfigWidgets ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5CoreAddons ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5Codecs ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5Config ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5I18n ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5IconThemes ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5ItemModels ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5XmlGui ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5WindowSystem ${KF5_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5DocTools ${KF5_WANT_VERSION} CONFIG)
 find_package(KF5Crash ${KF5_WANT_VERSION} REQUIRED)
 
 set_package_properties(KF5DocTools PROPERTIES
     DESCRIPTION "Documentation tools"
     PURPOSE "Required to generate Kleopatra documentation."
     TYPE OPTIONAL)
 
 # Optional packages
 if (WIN32)
   # Only a replacement available for Windows so this
   # is required on other platforms.
   find_package(KF5DBusAddons ${KF5_WANT_VERSION} CONFIG)
   set_package_properties(KF5DBusAddons PROPERTIES DESCRIPTION "Support library to work with DBus"
                          PURPOSE "DBus session integration"
                          URL "https://inqlude.org/libraries/kdbusaddons.html"
                          TYPE OPTIONAL)
 else()
   find_package(KF5DBusAddons ${KF5_WANT_VERSION} CONFIG REQUIRED)
   set(_kleopatra_dbusaddons_libs KF5::DBusAddons)
 endif()
 
 set(HAVE_QDBUS ${Qt${QT_MAJOR_VERSION}DBus_FOUND})
 
 find_package(Gpgmepp ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 if (QT_MAJOR_VERSION STREQUAL "6")
     find_package(QGpgmeQt6 ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 else()
     find_package(QGpgme ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 endif()
 if (QGpgme_VERSION VERSION_GREATER_EQUAL "1.17.0")
     set(QGPGME_SUPPORTS_CHANGING_EXPIRATION_OF_COMPLETE_KEY 1)
     set(QGPGME_CRYPTOCONFIGENTRY_HAS_DEFAULT_VALUE 1)
     set(QGPGME_SUPPORTS_WKDLOOKUP 1)
     set(QGPGME_SUPPORTS_IMPORT_WITH_FILTER 1)
     set(QGPGME_SUPPORTS_IMPORT_WITH_KEY_ORIGIN 1)
     set(QGPGME_SUPPORTS_SECRET_KEY_EXPORT 1)
     set(QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT 1)
     set(QGPGME_SUPPORTS_RECEIVING_KEYS_BY_KEY_ID 1)
 endif()
 if (QGpgme_VERSION VERSION_GREATER_EQUAL "1.18.0")
     set(QGPGME_SUPPORTS_KEY_REVOCATION 1)
     set(QGPGME_SUPPORTS_KEY_REFRESH 1)
     set(QGPGME_SUPPORTS_SET_FILENAME 1)
     set(QGPGME_SUPPORTS_SET_PRIMARY_UID 1)
 endif()
 if (Gpgmepp_VERSION VERSION_GREATER_EQUAL "1.18.1")
     set(GPGMEPP_SUPPORTS_SET_CURVE 1)
 endif()
 
 # Kdepimlibs packages
 find_package(KF5Libkleo ${LIBKLEO_VERSION} CONFIG REQUIRED)
 find_package(KF5Mime ${KMIME_WANT_VERSION} CONFIG REQUIRED)
 find_package(KF5IdentityManagement ${KIDENTITYMANAGEMENT_VERSION} CONFIG)
 find_package(KF5MailTransport ${KMAILTRANSPORT_VERSION} CONFIG)
 find_package(KF5MailTransportAkonadi ${KMAILTRANSPORT_VERSION} CONFIG)
 
 find_package(Qt${QT_MAJOR_VERSION} ${QT_REQUIRED_VERSION} CONFIG REQUIRED Widgets Test Network PrintSupport)
 
 find_package(Assuan2 REQUIRED)
 
 
 set(kleopatra_release FALSE)
 
 if(NOT kleopatra_release)
     find_package(Git)
     if(GIT_FOUND)
         execute_process(COMMAND ${GIT_EXECUTABLE} rev-parse
                         WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                         RESULT_VARIABLE rc
                         ERROR_QUIET)
         if(rc EQUAL 0)
             execute_process(COMMAND ${GIT_EXECUTABLE} log -1 --oneline --format=%h ${CMAKE_CURRENT_SOURCE_DIR}
                 WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                 OUTPUT_VARIABLE Kleopatra_WC_REVISION)
             string(REGEX REPLACE "\n" "" Kleopatra_WC_REVISION "${Kleopatra_WC_REVISION}")
 
             execute_process(COMMAND ${GIT_EXECUTABLE} log -1 --oneline --format=%cI ${CMAKE_CURRENT_SOURCE_DIR}
                 WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                 OUTPUT_VARIABLE Kleopatra_WC_LAST_CHANGED_DATE)
             string(REGEX REPLACE "^([0-9]+)-([0-9]+)-([0-9]+)T([0-9]+):([0-9]+):([0-9]+).*$" "\\1\\2\\3T\\4\\5\\6"
                    Kleopatra_WC_LAST_CHANGED_DATE "${Kleopatra_WC_LAST_CHANGED_DATE}")
 
             set(kleopatra_version "${kleopatra_version}+git${Kleopatra_WC_LAST_CHANGED_DATE}~${Kleopatra_WC_REVISION}")
         endif()
     endif()
 endif()
 
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/version-kleopatra.h.cmake ${CMAKE_CURRENT_BINARY_DIR}/version-kleopatra.h)
 
 include (ConfigureChecks.cmake)
 
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/config-kleopatra.h.cmake ${CMAKE_CURRENT_BINARY_DIR}/config-kleopatra.h)
 include_directories(
     ${CMAKE_CURRENT_BINARY_DIR}
     ${CMAKE_CURRENT_SOURCE_DIR}
     ${ASSUAN2_INCLUDES}
     )
 
 add_definitions(-D_ASSUAN_ONLY_GPG_ERRORS)
 if (WIN32)
 # On Windows, we need to use stuff deprecated since Qt 5.11, e.g. from QDesktopWidget
 ecm_set_disabled_deprecation_versions(QT 5.10.0  KF 5.100.0)
 else ()
 ecm_set_disabled_deprecation_versions(QT 5.15.0  KF 5.100.0)
 endif ()
 
 if(CMAKE_COMPILER_IS_GNUCXX)
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-missing-braces -Wno-parentheses -Wno-ignored-qualifiers")
 endif()
 if(MINGW)
     # we do not care about different signedness of passed pointer arguments
     add_compile_options(-Wno-pointer-sign)
 endif()
 
 add_definitions(-DQT_NO_EMIT)
 remove_definitions(-DQT_NO_FOREACH)
 
 # Disable the use of QStringBuilder for operator+ to prevent crashes when
 # returning the result of concatenating string temporaries in lambdas. We do
 # this for example in some std::transform expressions.
 # This is a known issue: https://bugreports.qt.io/browse/QTBUG-47066
 # Alternatively, one would always have to remember to force the lambdas to
 # return a QString instead of QStringBuilder, but that's just too easy to
 # forget and, unfortunately, the compiler doesn't issue a warning if one forgets
 # this. So, it's just too dangerous.
 # One can still use QStringBuilder explicitly with the operator% if necessary.
 remove_definitions(-DQT_USE_FAST_OPERATOR_PLUS)
 remove_definitions(-DQT_USE_QSTRINGBUILDER)
 
 kde_enable_exceptions()
 option(USE_UNITY_CMAKE_SUPPORT "Use UNITY cmake support (speedup compile time)" OFF)
 
 set(COMPILE_WITH_UNITY_CMAKE_SUPPORT OFF)
 if (USE_UNITY_CMAKE_SUPPORT)
     set(COMPILE_WITH_UNITY_CMAKE_SUPPORT ON)
 endif()
 
 
 add_subdirectory(pics)
 add_subdirectory(src)
 
 if(BUILD_TESTING)
     add_subdirectory(tests)
     add_subdirectory(autotests)
 endif()
 
 ecm_qt_install_logging_categories(
         EXPORT KLEOPATRA
         FILE kleopatra.categories
         DESTINATION ${KDE_INSTALL_LOGGINGCATEGORIESDIR}
         )
 
 ki18n_install(po)
 if(KF5DocTools_FOUND)
     kdoctools_install(po)
     add_subdirectory(doc)
 endif()
 feature_summary(WHAT ALL FATAL_ON_MISSING_REQUIRED_PACKAGES)
 
 # add clang-format target for all our real source files
 file(GLOB_RECURSE ALL_CLANG_FORMAT_SOURCE_FILES *.cpp *.h *.c)
 kde_clang_format(${ALL_CLANG_FORMAT_SOURCE_FILES})
diff --git a/src/commands/keytocardcommand.cpp b/src/commands/keytocardcommand.cpp
index b19529b8c..f09a0a427 100644
--- a/src/commands/keytocardcommand.cpp
+++ b/src/commands/keytocardcommand.cpp
@@ -1,503 +1,684 @@
 /* commands/keytocardcommand.cpp
 
     This file is part of Kleopatra, the KDE keymanager
     SPDX-FileCopyrightText: 2017 Bundesamt für Sicherheit in der Informationstechnik
     SPDX-FileContributor: Intevation GmbH
-    SPDX-FileCopyrightText: 2020 g10 Code GmbH
+    SPDX-FileCopyrightText: 2020,2022 g10 Code GmbH
     SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #include <config-kleopatra.h>
 
 #include "keytocardcommand.h"
 
 #include "cardcommand_p.h"
 
-#include "commands/authenticatepivcardapplicationcommand.h"
+#include "authenticatepivcardapplicationcommand.h"
 
 #include "smartcard/openpgpcard.h"
 #include "smartcard/pivcard.h"
 #include "smartcard/readerstatus.h"
 #include "smartcard/utils.h"
+#include <utils/applicationstate.h>
+#include <utils/filedialog.h>
 
+#include <Libkleo/Algorithm>
 #include <Libkleo/Dn>
 #include <Libkleo/Formatting>
+#include <Libkleo/GnuPG>
 #include <Libkleo/KeyCache>
 #include <Libkleo/KeySelectionDialog>
 
 #include <KLocalizedString>
 
 #include <QDateTime>
+#include <QDir>
 #include <QInputDialog>
+#include <QSaveFile>
 #include <QStringList>
 
 #include <gpg-error.h>
 #if GPG_ERROR_VERSION_NUMBER >= 0x12400 // 1.36
 # define GPG_ERROR_HAS_NO_AUTH
 #endif
 
 #include "kleopatra_debug.h"
 
 using namespace Kleo;
 using namespace Kleo::Commands;
 using namespace Kleo::SmartCard;
 using namespace GpgME;
 
 class KeyToCardCommand::Private : public CardCommand::Private
 {
     friend class ::Kleo::Commands::KeyToCardCommand;
     KeyToCardCommand *q_func() const
     {
         return static_cast<KeyToCardCommand *>(q);
     }
 public:
     explicit Private(KeyToCardCommand *qq, const GpgME::Subkey &subkey);
     explicit Private(KeyToCardCommand *qq, const std::string &slot, const std::string &serialNumber, const std::string &appName);
-    ~Private() override;
 
 private:
     void start();
 
     void startKeyToOpenPGPCard();
 
     Subkey getSubkeyToTransferToPIVCard(const std::string &cardSlot, const std::shared_ptr<PIVCard> &card);
     void startKeyToPIVCard();
 
     void authenticate();
     void authenticationFinished();
     void authenticationCanceled();
 
     void keyToCardDone(const GpgME::Error &err);
     void keyToPIVCardDone(const GpgME::Error &err);
 
     void keyHasBeenCopiedToCard();
+    bool backupKey();
+    std::vector<QByteArray> readSecretKeyFile();
+    bool writeSecretKeyBackup(const QString &filename, const std::vector<QByteArray> &keydata);
+
+    void startDeleteSecretKeyLocally();
+    void deleteSecretKeyLocallyFinished(const GpgME::Error &err);
 
 private:
     std::string appName;
     GpgME::Subkey subkey;
     std::string cardSlot;
     bool overwriteExistingAlreadyApproved = false;
     bool hasBeenCanceled = false;
 };
 
 KeyToCardCommand::Private *KeyToCardCommand::d_func()
 {
     return static_cast<Private *>(d.get());
 }
 const KeyToCardCommand::Private *KeyToCardCommand::d_func() const
 {
     return static_cast<const Private *>(d.get());
 }
 
 #define q q_func()
 #define d d_func()
 
-
 KeyToCardCommand::Private::Private(KeyToCardCommand *qq, const GpgME::Subkey &subkey_)
     : CardCommand::Private(qq, "", nullptr)
     , subkey(subkey_)
 {
 }
 
 KeyToCardCommand::Private::Private(KeyToCardCommand *qq, const std::string &slot, const std::string &serialNumber, const std::string &appName_)
     : CardCommand::Private(qq, serialNumber, nullptr)
     , appName(appName_)
     , cardSlot(slot)
 {
 }
 
-KeyToCardCommand::Private::~Private()
-{
-}
-
 namespace {
 static std::shared_ptr<Card> getCardToTransferSubkeyTo(const Subkey &subkey, QWidget *parent)
 {
     const std::vector<std::shared_ptr<Card> > suitableCards = KeyToCardCommand::getSuitableCards(subkey);
     if (suitableCards.empty()) {
         return std::shared_ptr<Card>();
     } else if (suitableCards.size() == 1) {
         return suitableCards[0];
     }
 
     QStringList options;
     for (const auto &card: suitableCards) {
         options.push_back(i18nc("smartcard application - serial number of smartcard", "%1 - %2",
             displayAppName(card->appName()), card->displaySerialNumber()));
     }
 
     bool ok;
     const QString choice = QInputDialog::getItem(parent, i18n("Select Card"),
         i18n("Please select the card the key should be written to:"), options, /* current= */ 0, /* editable= */ false, &ok);
     if (!ok) {
         return std::shared_ptr<Card>();
     }
     const int index = options.indexOf(choice);
     return suitableCards[index];
 }
 }
 
 void KeyToCardCommand::Private::start()
 {
     qCDebug(KLEOPATRA_LOG) << "KeyToCardCommand::Private::start()";
 
     if (!subkey.isNull() && serialNumber().empty()) {
         const auto card = getCardToTransferSubkeyTo(subkey, parentWidgetOrView());
         if (!card) {
             finished();
             return;
         }
         setSerialNumber(card->serialNumber());
         appName = card->appName();
     }
 
     const auto card = SmartCard::ReaderStatus::instance()->getCard(serialNumber(), appName);
     if (!card) {
         error(i18n("Failed to find the card with the serial number: %1", QString::fromStdString(serialNumber())));
         finished();
         return;
     }
 
     if (card->appName() == SmartCard::OpenPGPCard::AppName) {
         startKeyToOpenPGPCard();
     } else if (card->appName() == SmartCard::PIVCard::AppName) {
         startKeyToPIVCard();
     } else {
         error(i18n("Sorry! Transferring keys to this card is not supported."));
         finished();
         return;
     }
 }
 
 namespace {
 static int getOpenPGPCardSlotForKey(const GpgME::Subkey &subKey, QWidget *parent)
 {
     // Check if we need to ask the user for the slot
     if ((subKey.canSign() || subKey.canCertify()) && !subKey.canEncrypt() && !subKey.canAuthenticate()) {
         // Signing only
         return 1;
     }
     if (subKey.canEncrypt() && !(subKey.canSign() || subKey.canCertify()) && !subKey.canAuthenticate()) {
         // Encrypt only
         return 2;
     }
     if (subKey.canAuthenticate() && !(subKey.canSign() || subKey.canCertify()) && !subKey.canEncrypt()) {
         // Auth only
         return 3;
     }
     // Multiple uses, ask user.
     QStringList options;
 
     if (subKey.canSign() || subKey.canCertify()) {
         options << i18nc("Placeholder is the number of a slot on a smart card", "Signature (%1)", 1);
     }
     if (subKey.canEncrypt()) {
         options << i18nc("Placeholder is the number of a slot on a smart card", "Encryption (%1)", 2);
     }
     if (subKey.canAuthenticate()) {
         options << i18nc("Placeholder is the number of a slot on a smart card", "Authentication (%1)", 3);
     }
 
     bool ok;
     const QString choice = QInputDialog::getItem(parent, i18n("Select Card Slot"),
         i18n("Please select the card slot the key should be written to:"), options, /* current= */ 0, /* editable= */ false, &ok);
     const int slot = options.indexOf(choice) + 1;
     return ok ? slot : -1;
 }
 }
 
 void KeyToCardCommand::Private::startKeyToOpenPGPCard() {
     qCDebug(KLEOPATRA_LOG) << "KeyToCardCommand::Private::startKeyToOpenPGPCard()";
 
     const auto pgpCard = SmartCard::ReaderStatus::instance()->getCard<OpenPGPCard>(serialNumber());
     if (!pgpCard) {
         error(i18n("Failed to find the OpenPGP card with the serial number: %1", QString::fromStdString(serialNumber())));
         finished();
         return;
     }
 
     if (subkey.isNull()) {
         finished();
         return;
     }
     if (subkey.parent().protocol() != GpgME::OpenPGP) {
         error(i18n("Sorry! This key cannot be transferred to an OpenPGP card."));
         finished();
         return;
     }
 
     const auto slot = getOpenPGPCardSlotForKey(subkey, parentWidgetOrView());
     if (slot < 1) {
         finished();
         return;
     }
 
     // Check if we need to do the overwrite warning.
     std::string existingKey;
     QString encKeyWarning;
     if (slot == 1) {
         existingKey = pgpCard->keyFingerprint(OpenPGPCard::pgpSigKeyRef());
     } else if (slot == 2) {
         existingKey = pgpCard->keyFingerprint(OpenPGPCard::pgpEncKeyRef());
         encKeyWarning = i18n("It will no longer be possible to decrypt past communication "
                                 "encrypted for the existing key.");
     } else if (slot == 3) {
         existingKey = pgpCard->keyFingerprint(OpenPGPCard::pgpAuthKeyRef());
     }
     if (!existingKey.empty()) {
         const QString message = i18nc("@info",
             "<p>This card already contains a key in this slot. Continuing will <b>overwrite</b> that key.</p>"
             "<p>If there is no backup the existing key will be irrecoverably lost.</p>") +
             i18n("The existing key has the fingerprint:") +
             QStringLiteral("<pre>%1</pre>").arg(QString::fromStdString(existingKey)) +
             encKeyWarning;
         const auto choice = KMessageBox::warningContinueCancel(parentWidgetOrView(), message,
             i18nc("@title:window", "Overwrite existing key"),
             KGuiItem{i18nc("@action:button", "Overwrite Existing Key")}, KStandardGuiItem::cancel(), QString(), KMessageBox::Notify | KMessageBox::Dangerous);
         if (choice != KMessageBox::Continue) {
             finished();
             return;
         }
     }
 
     // Now do the deed
     const auto time = QDateTime::fromSecsSinceEpoch(quint32(subkey.creationTime()), Qt::UTC);
     const auto timestamp = time.toString(QStringLiteral("yyyyMMdd'T'HHmmss"));
     const QString cmd = QStringLiteral("KEYTOCARD --force %1 %2 OPENPGP.%3 %4")
         .arg(QString::fromLatin1(subkey.keyGrip()), QString::fromStdString(serialNumber()))
         .arg(slot)
         .arg(timestamp);
     ReaderStatus::mutableInstance()->startSimpleTransaction(pgpCard, cmd.toUtf8(), q_func(), [this](const GpgME::Error &err) {
         keyToCardDone(err);
     });
 }
 
 namespace {
 static std::vector<Key> getSigningCertificates()
 {
     std::vector<Key> signingCertificates = KeyCache::instance()->secretKeys();
     const auto it = std::remove_if(signingCertificates.begin(), signingCertificates.end(),
                                    [](const Key &key) {
                                        return ! (key.protocol() == GpgME::CMS &&
                                                  !key.subkey(0).isNull() &&
                                                  key.subkey(0).canSign() &&
                                                  !key.subkey(0).canEncrypt() &&
                                                  key.subkey(0).isSecret() &&
                                                  !key.subkey(0).isCardKey());
                                    });
     signingCertificates.erase(it, signingCertificates.end());
     return signingCertificates;
 }
 
 static std::vector<Key> getEncryptionCertificates()
 {
     std::vector<Key> encryptionCertificates = KeyCache::instance()->secretKeys();
     const auto it = std::remove_if(encryptionCertificates.begin(), encryptionCertificates.end(),
                                    [](const Key &key) {
                                        return ! (key.protocol() == GpgME::CMS &&
                                                  !key.subkey(0).isNull() &&
                                                  key.subkey(0).canEncrypt() &&
                                                  key.subkey(0).isSecret() &&
                                                  !key.subkey(0).isCardKey());
                                    });
     encryptionCertificates.erase(it, encryptionCertificates.end());
     return encryptionCertificates;
 }
 }
 
 Subkey KeyToCardCommand::Private::getSubkeyToTransferToPIVCard(const std::string &cardSlot, const std::shared_ptr<PIVCard> &/*card*/)
 {
     if (cardSlot != PIVCard::cardAuthenticationKeyRef() && cardSlot != PIVCard::keyManagementKeyRef()) {
         return Subkey();
     }
 
     const std::vector<Key> certificates = cardSlot == PIVCard::cardAuthenticationKeyRef() ? getSigningCertificates() : getEncryptionCertificates();
     if (certificates.empty()) {
         error(i18n("Sorry! No suitable certificate to write to this card slot was found."));
         return Subkey();
     }
 
     auto dialog = new KeySelectionDialog(parentWidgetOrView());
     dialog->setWindowTitle(i18nc("@title:window", "Select Certificate"));
     dialog->setText(i18n("Please select the certificate whose key pair you want to write to the card:"));
     dialog->setKeys(certificates);
 
     if (dialog->exec() == QDialog::Rejected) {
         return Subkey();
     }
 
     return dialog->selectedKey().subkey(0);
 }
 
 void KeyToCardCommand::Private::startKeyToPIVCard()
 {
     qCDebug(KLEOPATRA_LOG) << "KeyToCardCommand::Private::startKeyToPIVCard()";
 
     const auto pivCard = SmartCard::ReaderStatus::instance()->getCard<PIVCard>(serialNumber());
     if (!pivCard) {
         error(i18n("Failed to find the PIV card with the serial number: %1", QString::fromStdString(serialNumber())));
         finished();
         return;
     }
 
     if (cardSlot != PIVCard::cardAuthenticationKeyRef() && cardSlot != PIVCard::keyManagementKeyRef()) {
         // key to card is only supported for the Card Authentication key and the Key Management key
         finished();
         return;
     }
 
     if (subkey.isNull()) {
         subkey = getSubkeyToTransferToPIVCard(cardSlot, pivCard);
     }
     if (subkey.isNull()) {
         finished();
         return;
     }
     if (subkey.parent().protocol() != GpgME::CMS) {
         error(i18n("Sorry! This key cannot be transferred to a PIV card."));
         finished();
         return;
     }
     if (!subkey.canEncrypt() && !subkey.canSign()) {
         error(i18n("Sorry! Only encryption keys and signing keys can be transferred to a PIV card."));
         finished();
         return;
     }
 
     // Check if we need to do the overwrite warning.
     if (!overwriteExistingAlreadyApproved) {
         const std::string existingKey = pivCard->keyInfo(cardSlot).grip;
         if (!existingKey.empty() && (existingKey != subkey.keyGrip())) {
             const QString decryptionWarning = (cardSlot == PIVCard::keyManagementKeyRef()) ?
                 i18n("It will no longer be possible to decrypt past communication encrypted for the existing key.") :
                 QString();
             const QString message = i18nc("@info",
                 "<p>This card already contains a key in this slot. Continuing will <b>overwrite</b> that key.</p>"
                 "<p>If there is no backup the existing key will be irrecoverably lost.</p>") +
                 i18n("The existing key has the key grip:") +
                 QStringLiteral("<pre>%1</pre>").arg(QString::fromStdString(existingKey)) +
                 decryptionWarning;
             const auto choice = KMessageBox::warningContinueCancel(parentWidgetOrView(), message,
                 i18nc("@title:window", "Overwrite existing key"),
                 KGuiItem{i18nc("@action:button", "Overwrite Existing Key")}, KStandardGuiItem::cancel(), QString(), KMessageBox::Notify | KMessageBox::Dangerous);
             if (choice != KMessageBox::Continue) {
                 finished();
                 return;
             }
             overwriteExistingAlreadyApproved = true;
         }
     }
 
     const QString cmd = QStringLiteral("KEYTOCARD --force %1 %2 %3")
         .arg(QString::fromLatin1(subkey.keyGrip()), QString::fromStdString(serialNumber()))
         .arg(QString::fromStdString(cardSlot));
     ReaderStatus::mutableInstance()->startSimpleTransaction(pivCard, cmd.toUtf8(), q_func(), [this](const GpgME::Error &err) {
         keyToPIVCardDone(err);
     });
 }
 
 void KeyToCardCommand::Private::authenticate()
 {
     qCDebug(KLEOPATRA_LOG) << "KeyToCardCommand::authenticate()";
 
     auto cmd = new AuthenticatePIVCardApplicationCommand(serialNumber(), parentWidgetOrView());
     connect(cmd, &AuthenticatePIVCardApplicationCommand::finished,
             q, [this]() { authenticationFinished(); });
     connect(cmd, &AuthenticatePIVCardApplicationCommand::canceled,
             q, [this]() { authenticationCanceled(); });
     cmd->start();
 }
 
 void KeyToCardCommand::Private::authenticationFinished()
 {
     qCDebug(KLEOPATRA_LOG) << "KeyToCardCommand::authenticationFinished()";
     if (!hasBeenCanceled) {
         startKeyToPIVCard();
     }
 }
 
 void KeyToCardCommand::Private::authenticationCanceled()
 {
     qCDebug(KLEOPATRA_LOG) << "KeyToCardCommand::authenticationCanceled()";
     hasBeenCanceled = true;
     canceled();
 }
 
 void KeyToCardCommand::Private::keyHasBeenCopiedToCard()
 {
     ReaderStatus::mutableInstance()->updateStatus();
+
+    const auto answer = KMessageBox::questionTwoActionsCancel(
+        parentWidgetOrView(),
+        xi18nc("@info",
+               "<para>The key has been copied to the card.</para>"
+               "<para>Do you want to delete the copy of the key stored on this computer?</para>"),
+        i18nc("@title:window", "Success"),
+        KGuiItem{i18nc("@action:button", "Create Backup and Delete Key")},
+        KGuiItem{i18nc("@action:button", "Delete Key")},
+        KGuiItem{i18nc("@action:button", "Keep Key")});
+    if (answer == KMessageBox::ButtonCode::Cancel) {
+        finished();
+        return;
+    }
+    if (answer == KMessageBox::ButtonCode::PrimaryAction) {
+        if (!backupKey()) {
+            finished();
+            return;
+        }
+    }
+    startDeleteSecretKeyLocally();
+}
+
+namespace
+{
+QString gnupgPrivateKeyBackupExtension()
+{
+    return QStringLiteral(".gpgsk");
+}
+
+QString proposeFilename(const Subkey &subkey)
+{
+    QString filename;
+
+    const auto key = subkey.parent();
+    auto name = Formatting::prettyName(key);
+    if (name.isEmpty()) {
+        name = Formatting::prettyEMail(key);
+    }
+    const auto shortKeyID = Formatting::prettyKeyID(key.shortKeyID());
+    const auto shortSubkeyID = Formatting::prettyKeyID(QByteArray{subkey.keyID()}.right(8).constData());
+    const auto usage = Formatting::usageString(subkey).replace(QLatin1String{", "}, QLatin1String{"_"});
+    /* Not translated so it's better to use in tutorials etc. */
+    filename = ((shortKeyID == shortSubkeyID) //
+                ? QStringView{u"%1_%2_SECRET_KEY_BACKUP_%3"}.arg(name, shortKeyID, usage)
+                : QStringView{u"%1_%2_SECRET_KEY_BACKUP_%3_%4"}.arg(name, shortKeyID, shortSubkeyID, usage));
+    filename.replace(u'/', u'_');
+
+    return QDir{ApplicationState::lastUsedExportDirectory()}.filePath(filename + gnupgPrivateKeyBackupExtension());
+}
+
+QString requestPrivateKeyBackupFilename(const QString &proposedFilename, QWidget *parent)
+{
+    auto filename = FileDialog::getSaveFileNameEx(
+        parent,
+        i18nc("@title:window", "Backup Secret Key"),
+        QStringLiteral("imp"),
+        proposedFilename,
+        i18nc("description of filename filter", "Secret Key Backup Files") + QLatin1String{" (*.gpgsk)"});
+
+    if (!filename.isEmpty()) {
+        const QFileInfo fi{filename};
+        if (fi.suffix().isEmpty()) {
+            filename += gnupgPrivateKeyBackupExtension();
+        }
+        ApplicationState::setLastUsedExportDirectory(filename);
+    }
+
+    return filename;
+}
+}
+
+bool KeyToCardCommand::Private::backupKey()
+{
+    static const QByteArray backupInfoName = "Backup-info:";
+
+    auto keydata = readSecretKeyFile();
+    if (keydata.empty()) {
+        return false;
+    }
+    const auto filename = requestPrivateKeyBackupFilename(proposeFilename(subkey), parentWidgetOrView());
+    if (filename.isEmpty()) {
+        return false;
+    }
+
+    // remove old backup info
+    Kleo::erase_if(keydata, [](const auto &line) {
+        return line.startsWith(backupInfoName);
+    });
+    // prepend new backup info
+    const QByteArrayList backupInfo = {
+        backupInfoName,
+        subkey.keyGrip(),
+        QDateTime::currentDateTimeUtc().toString(Qt::ISODate).toUtf8(),
+        "Kleopatra",
+        Formatting::prettyNameAndEMail(subkey.parent()).toUtf8(),
+    };
+    keydata.insert(keydata.begin(), backupInfo.join(' ') + '\n');
+
+    return writeSecretKeyBackup(filename, keydata);
+}
+
+std::vector<QByteArray> KeyToCardCommand::Private::readSecretKeyFile()
+{
+    const auto filename = QString::fromLatin1(subkey.keyGrip()) + QLatin1String{".key"};
+    const auto path = QDir{Kleo::gnupgPrivateKeysDirectory()}.filePath(filename);
+
+    QFile file{path};
+    if (!file.open(QIODevice::ReadOnly | QIODevice::Text)) {
+        error(xi18n("Cannot open the private key file <filename>%1</filename> for reading.", path));
+        return {};
+    }
+
+    std::vector<QByteArray> lines;
+    while (!file.atEnd()) {
+        lines.push_back(file.readLine());
+    }
+    if (lines.empty()) {
+        error(xi18n("The private key file <filename>%1</filename> is empty.", path));
+    }
+    return lines;
+}
+
+bool KeyToCardCommand::Private::writeSecretKeyBackup(const QString &filename, const std::vector<QByteArray> &keydata)
+{
+    QSaveFile file{filename};
+    // open the file in binary format because we want to write Unix line endings
+    if (!file.open(QIODevice::WriteOnly)) {
+        error(xi18n("Cannot open the file <filename>%1</filename> for writing.", filename));
+        return false;
+    }
+    for (const auto &line : keydata) {
+        file.write(line);
+    }
+    if (!file.commit()) {
+        error(xi18n("Writing the backup of the secret key to <filename>%1</filename> failed.", filename));
+        return false;
+    };
+    return true;
+}
+
+void KeyToCardCommand::Private::startDeleteSecretKeyLocally()
+{
+    const auto card = SmartCard::ReaderStatus::instance()->getCard(serialNumber(), appName);
+    if (!card) {
+        error(i18n("Failed to find the card with the serial number: %1", QString::fromStdString(serialNumber())));
+        finished();
+        return;
+    }
+
+    const auto answer = KMessageBox::questionTwoActions(
+        parentWidgetOrView(),
+        xi18n("Do you really want to delete the local copy of the secret key?"),
+        i18nc("@title:window", "Confirm Deletion"),
+        KStandardGuiItem::del(),
+        KStandardGuiItem::cancel(),
+        {},
+        KMessageBox::Notify | KMessageBox::Dangerous);
+    if (answer != KMessageBox::ButtonCode::PrimayAction) {
+        finished();
+        return;
+    }
+
+    const auto cmd = QByteArray{"DELETE_KEY --force "} + subkey.keyGrip();
+    ReaderStatus::mutableInstance()->startSimpleTransaction(card, cmd, q, [this](const GpgME::Error &err) {
+        deleteSecretKeyLocallyFinished(err);
+    });
+}
+
+void KeyToCardCommand::Private::deleteSecretKeyLocallyFinished(const GpgME::Error &err)
+{
+    if (err) {
+        error(xi18nc("@info", "<para>Failed to delete the key:</para><para><message>%1</message></para>", QString::fromUtf8(err.asString())));
+    }
+    ReaderStatus::mutableInstance()->updateStatus();
     success(i18nc("@info", "Successfully copied the key to the card."));
     finished();
 }
 
 KeyToCardCommand::KeyToCardCommand(const GpgME::Subkey &subkey)
     : CardCommand(new Private(this, subkey))
 {
 }
 
 KeyToCardCommand::KeyToCardCommand(const std::string& cardSlot, const std::string &serialNumber, const std::string &appName)
     : CardCommand(new Private(this, cardSlot, serialNumber, appName))
 {
 }
 
 KeyToCardCommand::~KeyToCardCommand()
 {
     qCDebug(KLEOPATRA_LOG) << "KeyToCardCommand::~KeyToCardCommand()";
 }
 
 // static
 std::vector<std::shared_ptr<Card> > KeyToCardCommand::getSuitableCards(const GpgME::Subkey &subkey)
 {
     std::vector<std::shared_ptr<Card> > suitableCards;
     if (subkey.isNull() || subkey.parent().protocol() != GpgME::OpenPGP) {
         return suitableCards;
     }
     for (const auto &card: ReaderStatus::instance()->getCards()) {
         if (card->appName() == OpenPGPCard::AppName) {
             suitableCards.push_back(card);
         }
     }
     return suitableCards;
 }
 
 void KeyToCardCommand::Private::keyToCardDone(const GpgME::Error &err)
 {
     if (!err && !err.isCanceled()) {
         keyHasBeenCopiedToCard();
         return;
     }
     if (err) {
         error(xi18nc("@info",
                      "<para>Copying the key to the card failed:</para><para><message>%1</message></para>", QString::fromUtf8(err.asString())));
     }
     finished();
 }
 
 void KeyToCardCommand::Private::keyToPIVCardDone(const GpgME::Error &err)
 {
     qCDebug(KLEOPATRA_LOG) << q << __func__ << err.asString() << "(" << err.code() << ")";
 #ifdef GPG_ERROR_HAS_NO_AUTH
     // gpgme 1.13 reports "BAD PIN" instead of "NO AUTH"
     if (err.code() == GPG_ERR_NO_AUTH || err.code() == GPG_ERR_BAD_PIN) {
         authenticate();
         return;
     }
 #endif
     keyToCardDone(err);
 }
 
 void KeyToCardCommand::doStart()
 {
     qCDebug(KLEOPATRA_LOG) << "KeyToCardCommand::doStart()";
 
     d->start();
 }
 
 void KeyToCardCommand::doCancel()
 {
 }
 
 #undef q_func
 #undef d_func