diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2e2f3d8ab..8c2cb88dd 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,285 +1,285 @@
 # SPDX-FileCopyrightText: none
 # SPDX-License-Identifier: BSD-3-Clause
 cmake_minimum_required(VERSION 3.16 FATAL_ERROR)
 
 set(RELEASE_SERVICE_VERSION_MAJOR "23")
 set(RELEASE_SERVICE_VERSION_MINOR "07")
 set(RELEASE_SERVICE_VERSION_MICRO "70")
 
 # The RELEASE_SERVICE_VERSION is used by Gpg4win to add the Gpg4win version
 if (NOT RELEASE_SERVICE_VERSION)
     set(RELEASE_SERVICE_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}.${RELEASE_SERVICE_VERSION_MINOR}.${RELEASE_SERVICE_VERSION_MICRO}")
 endif()
 if(RELEASE_SERVICE_VERSION_MICRO LESS 10)
     set(KDE_APPLICATIONS_COMPACT_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}${RELEASE_SERVICE_VERSION_MINOR}0${RELEASE_SERVICE_VERSION_MICRO}")
 else()
     set(KDE_APPLICATIONS_COMPACT_VERSION "${RELEASE_SERVICE_VERSION_MAJOR}${RELEASE_SERVICE_VERSION_MINOR}${RELEASE_SERVICE_VERSION_MICRO}")
 endif()
 
 set(KLEOPATRA_VERSION_MAJOR "3")
 set(KLEOPATRA_VERSION_MINOR "1")
 set(KLEOPATRA_VERSION_MICRO "27")
 
 set(kleopatra_version "${KLEOPATRA_VERSION_MAJOR}.${KLEOPATRA_VERSION_MINOR}.${KLEOPATRA_VERSION_MICRO}.${KDE_APPLICATIONS_COMPACT_VERSION}")
 # The following is for Windows
 set(kleopatra_version_win "${KLEOPATRA_VERSION_MAJOR}.${KLEOPATRA_VERSION_MINOR}.${KLEOPATRA_VERSION_MICRO}")
 set(kleopatra_fileversion_win "${KLEOPATRA_VERSION_MAJOR},${KLEOPATRA_VERSION_MINOR},${KLEOPATRA_VERSION_MICRO},0")
 if (NOT KLEOPATRA_DISTRIBUTION_TEXT)
     # This is only used on Windows for the file attributes of Kleopatra
     set(KLEOPATRA_DISTRIBUTION_TEXT "KDE")
 endif()
 
 project(kleopatra VERSION ${kleopatra_version})
 
 option(DISABLE_KWATCHGNUPG "Don't build the kwatchgnupg tool [default=OFF]" OFF)
 
 # Standalone build. Find / include everything necessary.
 set(KF_MIN_VERSION "5.105.0")
 set(KIDENTITYMANAGEMENT_VERSION "5.23.40")
 set(KMAILTRANSPORT_VERSION "5.23.40")
 set(AKONADI_MIME_VERSION "5.23.41")
 set(KMIME_VERSION "5.23.40")
-set(LIBKLEO_VERSION "5.23.45")
+set(LIBKLEO_VERSION "5.23.46")
 set(QT_REQUIRED_VERSION "5.15.2")
 if (QT_MAJOR_VERSION STREQUAL "6")
     set(QT_REQUIRED_VERSION "6.4.0")
 endif()
 set(GPGME_REQUIRED_VERSION "1.16.0")
 set(LIBASSUAN_REQUIRED_VERSION "2.4.2")
 set(GPG_ERROR_REQUIRED_VERSION "1.36")
 
 if (WIN32)
   set(KF5_WANT_VERSION "5.70.0")
   set(KMIME_WANT_VERSION "5.12.0")
 else ()
   set(KF5_WANT_VERSION ${KF_MIN_VERSION})
   set(KMIME_WANT_VERSION ${KMIME_VERSION})
 endif ()
 
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 find_package(ECM ${KF5_WANT_VERSION} CONFIG REQUIRED)
 set(CMAKE_MODULE_PATH ${ECM_MODULE_PATH})
 set(CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules ${CMAKE_MODULE_PATH})
 
 include(ECMInstallIcons)
 include(ECMSetupVersion)
 include(ECMAddTests)
 include(GenerateExportHeader)
 include(ECMGenerateHeaders)
 include(FeatureSummary)
 include(CheckFunctionExists)
 include(KDEInstallDirs)
 include(KDECMakeSettings)
 include(KDECompilerSettings NO_POLICY_SCOPE)
 include(ECMAddAppIcon)
 include(ECMQtDeclareLoggingCategory)
 include(ECMDeprecationSettings)
 include(KDEClangFormat)
 
 if (QT_MAJOR_VERSION STREQUAL "6")
     set(QT_REQUIRED_VERSION "6.4.0")
     set(KF_MIN_VERSION "5.240.0")
     set(KF_MAJOR_VERSION "6")
 else()
     set(KF_MIN_VERSION "5.105.0")
     set(KF_MAJOR_VERSION "5")
 endif()
 
 # Find KF5 packages
 find_package(KF${KF_MAJOR_VERSION} ${KF5_WANT_VERSION}
     REQUIRED COMPONENTS
     Codecs
     Config
     ConfigWidgets
     CoreAddons
     Crash
     I18n
     IconThemes
     ItemModels
     KCMUtils
     KIO
     WidgetsAddons
     WindowSystem
     XmlGui
 
     OPTIONAL_COMPONENTS
     DocTools
 )
 
 set_package_properties(KF${KF_MAJOR_VERSION}DocTools PROPERTIES
     DESCRIPTION "Documentation tools"
     PURPOSE "Required to generate Kleopatra documentation."
     TYPE OPTIONAL)
 
 # Optional packages
 if (WIN32)
   # Only a replacement available for Windows so this
   # is required on other platforms.
   find_package(KF${KF_MAJOR_VERSION}DBusAddons ${KF5_WANT_VERSION} CONFIG)
   set_package_properties(KF${KF_MAJOR_VERSION}DBusAddons PROPERTIES DESCRIPTION "Support library to work with DBus"
                          PURPOSE "DBus session integration"
                          URL "https://inqlude.org/libraries/kdbusaddons.html"
                          TYPE OPTIONAL)
 else()
   find_package(KF${KF_MAJOR_VERSION}DBusAddons ${KF5_WANT_VERSION} CONFIG REQUIRED)
   set(_kleopatra_dbusaddons_libs KF${KF_MAJOR_VERSION}::DBusAddons)
 endif()
 
 set(HAVE_QDBUS ${Qt${QT_MAJOR_VERSION}DBus_FOUND})
 
 find_package(Gpgmepp ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 if (Gpgmepp_VERSION VERSION_GREATER_EQUAL "1.19.0")
     set(GPGMEPP_SUPPORTS_SET_CURVE 1)
 endif()
 if (Gpgmepp_VERSION VERSION_GREATER_EQUAL "1.19.1")
     set(GPGMEPP_KEY_CANSIGN_IS_FIXED 1)
 endif()
 if (QT_MAJOR_VERSION STREQUAL "6")
     find_package(QGpgmeQt6 ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 else()
     find_package(QGpgme ${GPGME_REQUIRED_VERSION} CONFIG REQUIRED)
 endif()
 if (QGpgme_VERSION VERSION_GREATER_EQUAL "1.17.0")
     set(QGPGME_SUPPORTS_CHANGING_EXPIRATION_OF_COMPLETE_KEY 1)
     set(QGPGME_CRYPTOCONFIGENTRY_HAS_DEFAULT_VALUE 1)
     set(QGPGME_SUPPORTS_WKDLOOKUP 1)
     set(QGPGME_SUPPORTS_IMPORT_WITH_FILTER 1)
     set(QGPGME_SUPPORTS_IMPORT_WITH_KEY_ORIGIN 1)
     set(QGPGME_SUPPORTS_SECRET_KEY_EXPORT 1)
     set(QGPGME_SUPPORTS_SECRET_SUBKEY_EXPORT 1)
     set(QGPGME_SUPPORTS_RECEIVING_KEYS_BY_KEY_ID 1)
 endif()
 if (QGpgme_VERSION VERSION_GREATER_EQUAL "1.18.0")
     set(QGPGME_SUPPORTS_KEY_REVOCATION 1)
     set(QGPGME_SUPPORTS_KEY_REFRESH 1)
     set(QGPGME_SUPPORTS_SET_FILENAME 1)
     set(QGPGME_SUPPORTS_SET_PRIMARY_UID 1)
 endif()
 if (QGpgme_VERSION VERSION_GREATER_EQUAL "1.19.0")
     set(QGPGME_SUPPORTS_DEFERRED_IMPORT_JOB 1)
     set(QGPGME_SUPPORTS_ARCHIVE_JOBS 1)
     set(QGPGME_JOB_HAS_NEW_PROGRESS_SIGNALS 1)
 endif()
 
 if (QT_MAJOR_VERSION STREQUAL "6")
     find_package(Qt6Core5Compat)
 endif()
 
 # Kdepimlibs packages
 find_package(KPim${KF_MAJOR_VERSION}Libkleo ${LIBKLEO_VERSION} CONFIG REQUIRED)
 find_package(KPim${KF_MAJOR_VERSION}Mime ${KMIME_WANT_VERSION} CONFIG REQUIRED)
 find_package(KPim${KF_MAJOR_VERSION}IdentityManagement ${KIDENTITYMANAGEMENT_VERSION} CONFIG)
 find_package(KPim${KF_MAJOR_VERSION}MailTransport ${KMAILTRANSPORT_VERSION} CONFIG)
 find_package(KPim${KF_MAJOR_VERSION}AkonadiMime ${AKONADI_MIME_VERSION} CONFIG)
 
 find_package(Qt${QT_MAJOR_VERSION} ${QT_REQUIRED_VERSION} CONFIG REQUIRED Widgets Test Network PrintSupport)
 
 find_package(LibAssuan ${LIBASSUAN_REQUIRED_VERSION} REQUIRED)
 set_package_properties(LibAssuan PROPERTIES
   TYPE REQUIRED
   PURPOSE "Needed for Kleopatra to act as the GnuPG UI Server"
 )
 find_package(LibGpgError ${GPG_ERROR_REQUIRED_VERSION} REQUIRED)
 set_package_properties(LibGpgError PROPERTIES
   TYPE REQUIRED
 )
 
 set(kleopatra_release FALSE)
 
 if(NOT kleopatra_release)
     find_package(Git)
     if(GIT_FOUND)
         execute_process(COMMAND ${GIT_EXECUTABLE} rev-parse
                         WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                         RESULT_VARIABLE rc
                         ERROR_QUIET)
         if(rc EQUAL 0)
             execute_process(COMMAND ${GIT_EXECUTABLE} log -1 --oneline --format=%h ${CMAKE_CURRENT_SOURCE_DIR}
                 WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                 OUTPUT_VARIABLE Kleopatra_WC_REVISION)
             string(REGEX REPLACE "\n" "" Kleopatra_WC_REVISION "${Kleopatra_WC_REVISION}")
 
             execute_process(COMMAND ${GIT_EXECUTABLE} log -1 --oneline --format=%cI ${CMAKE_CURRENT_SOURCE_DIR}
                 WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
                 OUTPUT_VARIABLE Kleopatra_WC_LAST_CHANGED_DATE)
             string(REGEX REPLACE "^([0-9]+)-([0-9]+)-([0-9]+)T([0-9]+):([0-9]+):([0-9]+).*$" "\\1\\2\\3T\\4\\5\\6"
                    Kleopatra_WC_LAST_CHANGED_DATE "${Kleopatra_WC_LAST_CHANGED_DATE}")
 
             set(kleopatra_version "${kleopatra_version}+git${Kleopatra_WC_LAST_CHANGED_DATE}~${Kleopatra_WC_REVISION}")
         endif()
     endif()
 endif()
 
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/version-kleopatra.h.cmake ${CMAKE_CURRENT_BINARY_DIR}/version-kleopatra.h)
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/config-kleopatra.h.cmake ${CMAKE_CURRENT_BINARY_DIR}/config-kleopatra.h)
 
 include_directories(
     ${CMAKE_CURRENT_BINARY_DIR}
     ${CMAKE_CURRENT_SOURCE_DIR}
 )
 
 if (WIN32)
 # On Windows, we need to use stuff deprecated since Qt 5.11, e.g. from QDesktopWidget
 ecm_set_disabled_deprecation_versions(QT 5.10.0  KF 5.103.0)
 else ()
 ecm_set_disabled_deprecation_versions(QT 6.4  KF 5.103.0)
 endif ()
 
 if(CMAKE_COMPILER_IS_GNUCXX)
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-missing-braces -Wno-parentheses -Wno-ignored-qualifiers")
 endif()
 if(MINGW)
     # we do not care about different signedness of passed pointer arguments
     add_compile_options($<$<COMPILE_LANGUAGE:C>:-Wno-pointer-sign>)
 endif()
 
 add_definitions(-DQT_NO_EMIT)
 remove_definitions(-DQT_NO_FOREACH)
 
 # Disable the use of QStringBuilder for operator+ to prevent crashes when
 # returning the result of concatenating string temporaries in lambdas. We do
 # this for example in some std::transform expressions.
 # This is a known issue: https://bugreports.qt.io/browse/QTBUG-47066
 # Alternatively, one would always have to remember to force the lambdas to
 # return a QString instead of QStringBuilder, but that's just too easy to
 # forget and, unfortunately, the compiler doesn't issue a warning if one forgets
 # this. So, it's just too dangerous.
 # One can still use QStringBuilder explicitly with the operator% if necessary.
 remove_definitions(-DQT_USE_FAST_OPERATOR_PLUS)
 remove_definitions(-DQT_USE_QSTRINGBUILDER)
 
 kde_enable_exceptions()
 option(USE_UNITY_CMAKE_SUPPORT "Use UNITY cmake support (speedup compile time)" OFF)
 
 set(COMPILE_WITH_UNITY_CMAKE_SUPPORT OFF)
 if (USE_UNITY_CMAKE_SUPPORT)
     set(COMPILE_WITH_UNITY_CMAKE_SUPPORT ON)
 endif()
 
 
 add_subdirectory(pics)
 add_subdirectory(src)
 
 if(BUILD_TESTING)
     add_subdirectory(tests)
     add_subdirectory(autotests)
 endif()
 
 ecm_qt_install_logging_categories(
         EXPORT KLEOPATRA
         FILE kleopatra.categories
         DESTINATION ${KDE_INSTALL_LOGGINGCATEGORIESDIR}
         )
 
 ki18n_install(po)
 if(KF${KF_MAJOR_VERSION}DocTools_FOUND)
     kdoctools_install(po)
     add_subdirectory(doc)
 endif()
 feature_summary(WHAT ALL FATAL_ON_MISSING_REQUIRED_PACKAGES)
 
 # add clang-format target for all our real source files
 file(GLOB_RECURSE ALL_CLANG_FORMAT_SOURCE_FILES *.cpp *.h *.c)
 kde_clang_format(${ALL_CLANG_FORMAT_SOURCE_FILES})
diff --git a/src/crypto/gui/certificatelineedit.cpp b/src/crypto/gui/certificatelineedit.cpp
index 663f7ba78..2cf87e30e 100644
--- a/src/crypto/gui/certificatelineedit.cpp
+++ b/src/crypto/gui/certificatelineedit.cpp
@@ -1,726 +1,798 @@
 /*  crypto/gui/certificatelineedit.cpp
 
     This file is part of Kleopatra, the KDE keymanager
     SPDX-FileCopyrightText: 2016 Bundesamt für Sicherheit in der Informationstechnik
     SPDX-FileContributor: Intevation GmbH
     SPDX-FileCopyrightText: 2021, 2022 g10 Code GmbH
     SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
 
     SPDX-License-Identifier: GPL-2.0-or-later
 */
 
 #include "certificatelineedit.h"
 
 #include "commands/detailscommand.h"
 #include "dialogs/groupdetailsdialog.h"
 #include "utils/accessibility.h"
 #include "view/errorlabel.h"
 
 #include <QAccessible>
 #include <QCompleter>
 #include <QPushButton>
 #include <QAction>
 #include <QSignalBlocker>
 
 #include "kleopatra_debug.h"
 
 #include <Libkleo/Debug>
 #include <Libkleo/KeyCache>
 #include <Libkleo/KeyFilter>
 #include <Libkleo/KeyGroup>
 #include <Libkleo/KeyList>
 #include <Libkleo/KeyListModel>
 #include <Libkleo/KeyListSortFilterProxyModel>
 #include <Libkleo/Formatting>
 
 #include <KLocalizedString>
 
 #include <gpgme++/key.h>
 #include <gpgme++/keylistresult.h>
 
 #include <QGpgME/KeyListJob>
 #include <QGpgME/Protocol>
 
 #include <QHBoxLayout>
 #include <QLineEdit>
 #include <QMenu>
 #include <QToolButton>
 
 using namespace Kleo;
 using namespace GpgME;
 
 Q_DECLARE_METATYPE(GpgME::Key)
 Q_DECLARE_METATYPE(KeyGroup)
 
 static QStringList s_lookedUpKeys;
 
 namespace
 {
 class CompletionProxyModel : public KeyListSortFilterProxyModel
 {
     Q_OBJECT
 
 public:
     CompletionProxyModel(QObject *parent = nullptr)
         : KeyListSortFilterProxyModel(parent)
     {
     }
 
     int columnCount(const QModelIndex &parent = QModelIndex()) const override
     {
         Q_UNUSED(parent)
         // pretend that there is only one column to workaround a bug in
         // QAccessibleTable which provides the accessibility interface for the
         // completion pop-up
         return 1;
     }
 
     QVariant data(const QModelIndex &idx, int role) const override
     {
         if (!idx.isValid()) {
             return QVariant();
         }
 
         switch (role) {
         case Qt::DecorationRole: {
             const auto key = KeyListSortFilterProxyModel::data(idx, KeyList::KeyRole).value<GpgME::Key>();
             if (!key.isNull()) {
                 return Kleo::Formatting::iconForUid(key.userID(0));
             }
 
             const auto group = KeyListSortFilterProxyModel::data(idx, KeyList::GroupRole).value<KeyGroup>();
             if (!group.isNull()) {
                 return QIcon::fromTheme(QStringLiteral("group"));
             }
 
             Q_ASSERT(!key.isNull() || !group.isNull());
             return QVariant();
         }
         default:
             return KeyListSortFilterProxyModel::data(index(idx.row(), KeyList::Summary), role);
         }
     }
+
+private:
+    bool lessThan(const QModelIndex &left, const QModelIndex &right) const override
+    {
+        const auto leftKey = sourceModel()->data(left, KeyList::KeyRole).value<GpgME::Key>();
+        const auto leftGroup = leftKey.isNull() ? sourceModel()->data(left, KeyList::GroupRole).value<KeyGroup>() : KeyGroup{};
+        const auto rightKey = sourceModel()->data(right, KeyList::KeyRole).value<GpgME::Key>();
+        const auto rightGroup = rightKey.isNull() ? sourceModel()->data(right, KeyList::GroupRole).value<KeyGroup>() : KeyGroup{};
+
+        // shouldn't happen, but still put null entries at the end
+        if (leftKey.isNull() && leftGroup.isNull()) {
+            return false;
+        }
+        if (rightKey.isNull() && rightGroup.isNull()) {
+            return true;
+        }
+
+        // first sort by the displayed name and/or email address
+        const auto leftNameAndOrEmail = leftGroup.isNull() ? Formatting::nameAndEmailForSummaryLine(leftKey) : leftGroup.name();
+        const auto rightNameAndOrEmail = rightGroup.isNull() ? Formatting::nameAndEmailForSummaryLine(rightKey) : rightGroup.name();
+        const int cmp = QString::localeAwareCompare(leftNameAndOrEmail, rightNameAndOrEmail);
+        if (cmp) {
+            return cmp < 0;
+        }
+        // then sort groups before certificates
+        if (!leftGroup.isNull() && !rightKey.isNull()) {
+            return true; // left is group, right is certificate
+        }
+        if (!leftKey.isNull() && !rightGroup.isNull()) {
+            return false; // left is certificate, right is group
+        }
+
+        // if both are groups (with identical names) sort them by their ID
+        if (!leftGroup.isNull() && !rightGroup.isNull()) {
+            return leftGroup.id() < rightGroup.id();
+        }
+
+        // sort certificates with same name/email by validity and creation time
+        const auto lUid = leftKey.userID(0);
+        const auto rUid = rightKey.userID(0);
+        if (lUid.validity() != rUid.validity()) {
+            return lUid.validity() > rUid.validity();
+        }
+
+        /* Both have the same validity, check which one is newer. */
+        time_t leftTime = 0;
+        for (const GpgME::Subkey &s : leftKey.subkeys()) {
+            if (s.isBad()) {
+                continue;
+            }
+            if (s.creationTime() > leftTime) {
+                leftTime = s.creationTime();
+            }
+        }
+        time_t rightTime = 0;
+        for (const GpgME::Subkey &s : rightKey.subkeys()) {
+            if (s.isBad()) {
+                continue;
+            }
+            if (s.creationTime() > rightTime) {
+                rightTime = s.creationTime();
+            }
+        }
+        if (rightTime != leftTime) {
+            return leftTime > rightTime;
+        }
+
+        // as final resort we compare the fingerprints
+        return strcmp(leftKey.primaryFingerprint(), rightKey.primaryFingerprint()) < 0;
+    }
 };
 
 auto createSeparatorAction(QObject *parent)
 {
     auto action = new QAction{parent};
     action->setSeparator(true);
     return action;
 }
 } // namespace
 
 class CertificateLineEdit::Private
 {
     CertificateLineEdit *q;
 
 public:
     enum class Status
     {
         Empty,      //< text is empty
         Success,    //< a certificate or group is set
         None,       //< entered text does not match any certificates or groups
         Ambiguous,  //< entered text matches multiple certificates or groups
     };
     enum class CursorPositioning
     {
         MoveToEnd,
         KeepPosition,
         MoveToStart,
         Default = MoveToEnd,
     };
 
     explicit Private(CertificateLineEdit *qq, AbstractKeyListModel *model, KeyFilter *filter);
 
     QString text() const;
 
     void setKey(const GpgME::Key &key);
 
     void setGroup(const KeyGroup &group);
 
     void setKeyFilter(const std::shared_ptr<KeyFilter> &filter);
 
     void setAccessibleName(const QString &s);
 
 private:
     void updateKey(CursorPositioning positioning);
     void editChanged();
     void editFinished();
     void checkLocate();
     void onLocateJobResult(QGpgME::Job *job, const QString &email, const KeyListResult &result, const std::vector<GpgME::Key> &keys);
     void openDetailsDialog();
     void setTextWithBlockedSignals(const QString &s, CursorPositioning positioning);
     void showContextMenu(const QPoint &pos);
     QString errorMessage() const;
     QIcon statusIcon() const;
     QString statusToolTip() const;
     void updateStatusAction();
     void updateErrorLabel();
     void updateAccessibleNameAndDescription();
 
 public:
     Status mStatus = Status::Empty;
     bool mEditingInProgress = false;
     GpgME::Key mKey;
     KeyGroup mGroup;
 
     struct Ui {
         explicit Ui(QWidget *parent)
             : lineEdit{parent}
             , button{parent}
             , errorLabel{parent}
         {}
 
         QLineEdit lineEdit;
         QToolButton button;
         ErrorLabel errorLabel;
     } ui;
 
 private:
     QString mAccessibleName;
     KeyListSortFilterProxyModel *const mFilterModel;
-    KeyListSortFilterProxyModel *const mCompleterFilterModel;
+    CompletionProxyModel *const mCompleterFilterModel;
     QCompleter *mCompleter = nullptr;
     std::shared_ptr<KeyFilter> mFilter;
     QAction *const mStatusAction;
     QAction *const mShowDetailsAction;
     QPointer<QGpgME::Job> mLocateJob;
 };
 
 CertificateLineEdit::Private::Private(CertificateLineEdit *qq, AbstractKeyListModel *model, KeyFilter *filter)
     : q{qq}
     , ui{qq}
     , mFilterModel{new KeyListSortFilterProxyModel{qq}}
     , mCompleterFilterModel{new CompletionProxyModel{qq}}
     , mCompleter{new QCompleter{qq}}
     , mFilter{std::shared_ptr<KeyFilter>{filter}}
     , mStatusAction{new QAction{qq}}
     , mShowDetailsAction{new QAction{qq}}
 {
     ui.lineEdit.setPlaceholderText(i18n("Please enter a name or email address..."));
     ui.lineEdit.setClearButtonEnabled(true);
     ui.lineEdit.setContextMenuPolicy(Qt::CustomContextMenu);
     ui.lineEdit.addAction(mStatusAction, QLineEdit::LeadingPosition);
 
     mCompleterFilterModel->setKeyFilter(mFilter);
     mCompleterFilterModel->setSourceModel(model);
+    // initialize dynamic sorting
+    mCompleterFilterModel->sort(0);
     mCompleter->setModel(mCompleterFilterModel);
     mCompleter->setFilterMode(Qt::MatchContains);
     mCompleter->setCaseSensitivity(Qt::CaseInsensitive);
     ui.lineEdit.setCompleter(mCompleter);
 
     ui.button.setIcon(QIcon::fromTheme(QStringLiteral("resource-group-new")));
     ui.button.setToolTip(i18n("Show certificate list"));
     ui.button.setAccessibleName(i18n("Show certificate list"));
 
     ui.errorLabel.setVisible(false);
 
     auto vbox = new QVBoxLayout{q};
     vbox->setContentsMargins(0, 0, 0, 0);
 
     auto l = new QHBoxLayout;
     l->setContentsMargins(0, 0, 0, 0);
     l->addWidget(&ui.lineEdit);
     l->addWidget(&ui.button);
 
     vbox->addLayout(l);
     vbox->addWidget(&ui.errorLabel);
 
     q->setFocusPolicy(ui.lineEdit.focusPolicy());
     q->setFocusProxy(&ui.lineEdit);
 
     mShowDetailsAction->setIcon(QIcon::fromTheme(QStringLiteral("help-about")));
     mShowDetailsAction->setText(i18nc("@action:inmenu", "Show Details"));
     mShowDetailsAction->setEnabled(false);
 
     mFilterModel->setSourceModel(model);
     mFilterModel->setFilterKeyColumn(KeyList::Summary);
     if (filter) {
         mFilterModel->setKeyFilter(mFilter);
     }
 
     connect(KeyCache::instance().get(), &Kleo::KeyCache::keysMayHaveChanged,
             q, [this]() { updateKey(CursorPositioning::KeepPosition); });
     connect(KeyCache::instance().get(), &Kleo::KeyCache::groupUpdated,
             q, [this](const KeyGroup &group) {
                 if (!mGroup.isNull() && mGroup.source() == group.source() && mGroup.id() == group.id()) {
                     setTextWithBlockedSignals(Formatting::summaryLine(group), CursorPositioning::KeepPosition);
                     // queue the update to ensure that the model has been updated
                     QMetaObject::invokeMethod(q, [this]() { updateKey(CursorPositioning::KeepPosition); }, Qt::QueuedConnection);
                 }
             });
     connect(KeyCache::instance().get(), &Kleo::KeyCache::groupRemoved,
             q, [this](const KeyGroup &group) {
                 if (!mGroup.isNull() && mGroup.source() == group.source() && mGroup.id() == group.id()) {
                     mGroup = KeyGroup();
                     QSignalBlocker blocky{&ui.lineEdit};
                     ui.lineEdit.clear();
                     // queue the update to ensure that the model has been updated
                     QMetaObject::invokeMethod(q, [this]() { updateKey(CursorPositioning::KeepPosition); }, Qt::QueuedConnection);
                 }
             });
     connect(&ui.lineEdit, &QLineEdit::editingFinished,
             q, [this]() {
                 // queue the call of editFinished() to ensure that QCompleter::activated is handled first
                 QMetaObject::invokeMethod(q, [this]() { editFinished(); }, Qt::QueuedConnection);
             });
     connect(&ui.lineEdit, &QLineEdit::textChanged,
             q, [this]() { editChanged(); });
     connect(&ui.lineEdit, &QLineEdit::customContextMenuRequested,
             q, [this](const QPoint &pos) { showContextMenu(pos); });
     connect(mStatusAction, &QAction::triggered,
             q, [this]() { openDetailsDialog(); });
     connect(mShowDetailsAction, &QAction::triggered,
             q, [this]() { openDetailsDialog(); });
     connect(&ui.button, &QToolButton::clicked,
             q, &CertificateLineEdit::certificateSelectionRequested);
     connect(mCompleter, qOverload<const QModelIndex &>(&QCompleter::activated),
             q, [this] (const QModelIndex &index) {
                 Key key = mCompleter->completionModel()->data(index, KeyList::KeyRole).value<Key>();
                 auto group = mCompleter->completionModel()->data(index, KeyList::GroupRole).value<KeyGroup>();
                 if (!key.isNull()) {
                     q->setKey(key);
                 } else if (!group.isNull()) {
                     q->setGroup(group);
                 } else {
                     qCDebug(KLEOPATRA_LOG) << "Activated item is neither key nor group";
                 }
                 // queue the call of editFinished() to ensure that QLineEdit finished its own work
                 QMetaObject::invokeMethod(q, [this]() { editFinished(); }, Qt::QueuedConnection);
             });
     updateKey(CursorPositioning::Default);
 }
 
 void CertificateLineEdit::Private::openDetailsDialog()
 {
     if (!q->key().isNull()) {
         auto cmd = new Commands::DetailsCommand{q->key()};
         cmd->setParentWidget(q);
         cmd->start();
     } else if (!q->group().isNull()) {
         auto dlg = new Dialogs::GroupDetailsDialog{q};
         dlg->setAttribute(Qt::WA_DeleteOnClose);
         dlg->setGroup(q->group());
         dlg->show();
     }
 }
 
 void CertificateLineEdit::Private::setTextWithBlockedSignals(const QString &s, CursorPositioning positioning)
 {
     QSignalBlocker blocky{&ui.lineEdit};
     const auto cursorPos = ui.lineEdit.cursorPosition();
     ui.lineEdit.setText(s);
     switch(positioning)
     {
     case CursorPositioning::KeepPosition:
         ui.lineEdit.setCursorPosition(cursorPos);
         break;
     case CursorPositioning::MoveToStart:
         ui.lineEdit.setCursorPosition(0);
         break;
     case CursorPositioning::MoveToEnd:
     default:
         ; // setText() already moved the cursor to the end of the line
     };
 }
 
 void CertificateLineEdit::Private::showContextMenu(const QPoint &pos)
 {
     if (QMenu *menu = ui.lineEdit.createStandardContextMenu()) {
         auto *const firstStandardAction = menu->actions().value(0);
         menu->insertActions(firstStandardAction,
                             {mShowDetailsAction, createSeparatorAction(menu)});
         menu->setAttribute(Qt::WA_DeleteOnClose);
         menu->popup(ui.lineEdit.mapToGlobal(pos));
     }
 }
 
 CertificateLineEdit::CertificateLineEdit(AbstractKeyListModel *model,
                                          KeyFilter *filter,
                                          QWidget *parent)
     : QWidget{parent}
     , d{new Private{this, model, filter}}
 {
     /* Take ownership of the model to prevent double deletion when the
      * filter models are deleted */
     model->setParent(parent ? parent : this);
 }
 
 CertificateLineEdit::~CertificateLineEdit() = default;
 
 void CertificateLineEdit::Private::editChanged()
 {
     const bool editingStarted = !mEditingInProgress;
     mEditingInProgress = true;
     updateKey(CursorPositioning::Default);
     if (editingStarted) {
         Q_EMIT q->editingStarted();
     }
     if (q->isEmpty()) {
         Q_EMIT q->cleared();
     }
 }
 
 void CertificateLineEdit::Private::editFinished()
 {
     // perform a first update with the "editing in progress" flag still set
     updateKey(CursorPositioning::MoveToStart);
     mEditingInProgress = false;
     checkLocate();
     // perform another update with the "editing in progress" flag cleared
     // after a key locate may have been started; this makes sure that displaying
     // an error is delayed until the key locate job has finished
     updateKey(CursorPositioning::MoveToStart);
 }
 
 void CertificateLineEdit::Private::checkLocate()
 {
     if (mStatus != Status::None) {
         // try to locate key only if text matches no local certificates or groups
         return;
     }
 
     // Only check once per mailbox
     const auto mailText = ui.lineEdit.text().trimmed();
     if (mailText.isEmpty() || s_lookedUpKeys.contains(mailText)) {
         return;
     }
     s_lookedUpKeys << mailText;
     if (mLocateJob) {
         mLocateJob->slotCancel();
         mLocateJob.clear();
     }
     auto job = QGpgME::openpgp()->locateKeysJob();
     connect(job, &QGpgME::KeyListJob::result, q, [this, job, mailText](const KeyListResult &result, const std::vector<GpgME::Key> &keys) {
         onLocateJobResult(job, mailText, result, keys);
     });
     if (auto err = job->start({mailText}, /*secretOnly=*/false)) {
         qCDebug(KLEOPATRA_LOG) << __func__ << "Error: Starting" << job << "for" << mailText << "failed with" << Formatting::errorAsString(err);
     } else {
         mLocateJob = job;
         qCDebug(KLEOPATRA_LOG) << __func__ << "Started" << job << "for" << mailText;
 
     }
 }
 
 void CertificateLineEdit::Private::onLocateJobResult(QGpgME::Job *job, const QString &email, const KeyListResult &result, const std::vector<GpgME::Key> &keys)
 {
     if (mLocateJob != job) {
         qCDebug(KLEOPATRA_LOG) << __func__ << "Ignoring outdated finished" << job << "for" << email;
         return;
     }
     qCDebug(KLEOPATRA_LOG) << __func__ << job << "for" << email << "finished with" << Formatting::errorAsString(result.error()) << "and keys" << keys;
     mLocateJob.clear();
     if (!keys.empty() && !keys.front().isNull()) {
         KeyCache::mutableInstance()->insert(keys.front());
         // inserting the key implicitly triggers an update
     } else {
         // explicitly trigger an update to display "no key" error
         updateKey(CursorPositioning::MoveToStart);
     }
 }
 
 void CertificateLineEdit::Private::updateKey(CursorPositioning positioning)
 {
     static const _detail::ByFingerprint<std::equal_to> keysHaveSameFingerprint;
 
     const auto mailText = ui.lineEdit.text().trimmed();
     auto newKey = Key();
     auto newGroup = KeyGroup();
     if (mailText.isEmpty()) {
         mStatus = Status::Empty;
     } else {
         mFilterModel->setFilterRegularExpression(QRegularExpression::escape(mailText));
         if (mFilterModel->rowCount() > 1) {
             // keep current key or group if they still match
             if (!mKey.isNull()) {
                 for (int row = 0; row < mFilterModel->rowCount(); ++row) {
                     const QModelIndex index = mFilterModel->index(row, 0);
                     Key key = mFilterModel->key(index);
                     if (!key.isNull() && keysHaveSameFingerprint(key, mKey)) {
                         newKey = mKey;
                         break;
                     }
                 }
             } else if (!mGroup.isNull()) {
                 newGroup = mGroup;
                 for (int row = 0; row < mFilterModel->rowCount(); ++row) {
                     const QModelIndex index = mFilterModel->index(row, 0);
                     KeyGroup group = mFilterModel->group(index);
                     if (!group.isNull() && group.source() == mGroup.source() && group.id() == mGroup.id()) {
                         newGroup = mGroup;
                         break;
                     }
                 }
             }
             if (newKey.isNull() && newGroup.isNull()) {
                 mStatus = Status::Ambiguous;
             }
         } else if (mFilterModel->rowCount() == 1) {
             const auto index = mFilterModel->index(0, 0);
             newKey = mFilterModel->data(index, KeyList::KeyRole).value<Key>();
             newGroup = mFilterModel->data(index, KeyList::GroupRole).value<KeyGroup>();
             Q_ASSERT(!newKey.isNull() || !newGroup.isNull());
             if (newKey.isNull() && newGroup.isNull()) {
                 mStatus = Status::None;
             }
         } else {
             mStatus = Status::None;
         }
     }
     mKey = newKey;
     mGroup = newGroup;
 
     if (!mKey.isNull()) {
         /* FIXME: This needs to be solved by a multiple UID supporting model */
         mStatus = Status::Success;
         ui.lineEdit.setToolTip(Formatting::toolTip(mKey, Formatting::ToolTipOption::AllOptions));
         if (!mEditingInProgress) {
             setTextWithBlockedSignals(Formatting::summaryLine(mKey), positioning);
         }
     } else if (!mGroup.isNull()) {
         mStatus = Status::Success;
         ui.lineEdit.setToolTip(Formatting::toolTip(mGroup, Formatting::ToolTipOption::AllOptions));
         if (!mEditingInProgress) {
             setTextWithBlockedSignals(Formatting::summaryLine(mGroup), positioning);
         }
     } else {
         ui.lineEdit.setToolTip({});
     }
 
     mShowDetailsAction->setEnabled(mStatus == Status::Success);
     updateStatusAction();
     updateErrorLabel();
 
     Q_EMIT q->keyChanged();
 }
 
 QString CertificateLineEdit::Private::errorMessage() const
 {
     switch (mStatus) {
     case Status::Empty:
     case Status::Success:
         return {};
     case Status::None:
         return i18n("No matching certificates or groups found");
     case Status::Ambiguous:
         return i18n("Multiple matching certificates or groups found");
     default:
         qDebug(KLEOPATRA_LOG) << __func__ << "Invalid status:" << static_cast<int>(mStatus);
         Q_ASSERT(!"Invalid status");
     };
     return {};
 }
 
 QIcon CertificateLineEdit::Private::statusIcon() const
 {
     switch (mStatus) {
     case Status::Empty:
         return QIcon::fromTheme(QStringLiteral("emblem-unavailable"));
     case Status::Success:
         if (!mKey.isNull()) {
             return Formatting::iconForUid(mKey.userID(0));
         } else if (!mGroup.isNull()) {
             return Formatting::validityIcon(mGroup);
         } else {
             qDebug(KLEOPATRA_LOG) << __func__ << "Success, but neither key nor group.";
             return {};
         }
     case Status::None:
     case Status::Ambiguous:
         if (mEditingInProgress || mLocateJob) {
             return QIcon::fromTheme(QStringLiteral("emblem-question"));
         } else {
             return QIcon::fromTheme(QStringLiteral("emblem-error"));
         }
     default:
         qDebug(KLEOPATRA_LOG) << __func__ << "Invalid status:" << static_cast<int>(mStatus);
         Q_ASSERT(!"Invalid status");
     };
     return {};
 }
 
 QString CertificateLineEdit::Private::statusToolTip() const
 {
     switch (mStatus) {
     case Status::Empty:
         return {};
     case Status::Success:
         if (!mKey.isNull()) {
             return Formatting::validity(mKey.userID(0));
         } else if (!mGroup.isNull()) {
             return Formatting::validity(mGroup);
         } else {
             qDebug(KLEOPATRA_LOG) << __func__ << "Success, but neither key nor group.";
             return {};
         }
     case Status::None:
     case Status::Ambiguous:
         return errorMessage();
     default:
         qDebug(KLEOPATRA_LOG) << __func__ << "Invalid status:" << static_cast<int>(mStatus);
         Q_ASSERT(!"Invalid status");
     };
     return {};
 }
 
 void CertificateLineEdit::Private::updateStatusAction()
 {
     mStatusAction->setIcon(statusIcon());
     mStatusAction->setToolTip(statusToolTip());
 }
 
 namespace
 {
 QString decoratedError(const QString &text)
 {
     return text.isEmpty() ? QString() : i18nc("@info", "Error: %1", text);
 }
 }
 
 void CertificateLineEdit::Private::updateErrorLabel()
 {
     const auto currentErrorMessage = ui.errorLabel.text();
     const auto newErrorMessage = decoratedError(errorMessage());
     if (newErrorMessage == currentErrorMessage) {
         return;
     }
     if (currentErrorMessage.isEmpty() && (mEditingInProgress || mLocateJob)) {
         // delay showing the error message until editing is finished, so that we
         // do not annoy the user with an error message while they are still
         // entering the recipient;
         // on the other hand, we clear the error message immediately if it does
         // not apply anymore and we update the error message immediately if it
         // changed
         return;
     }
     ui.errorLabel.setVisible(!newErrorMessage.isEmpty());
     ui.errorLabel.setText(newErrorMessage);
     updateAccessibleNameAndDescription();
 }
 
 void CertificateLineEdit::Private::setAccessibleName(const QString &s)
 {
     mAccessibleName = s;
     updateAccessibleNameAndDescription();
 }
 
 void CertificateLineEdit::Private::updateAccessibleNameAndDescription()
 {
     // fall back to default accessible name if accessible name wasn't set explicitly
     if (mAccessibleName.isEmpty()) {
         mAccessibleName = getAccessibleName(&ui.lineEdit);
     }
     const bool errorShown = ui.errorLabel.isVisible();
 
     // Qt does not support "described-by" relations (like WCAG's "aria-describedby" relationship attribute);
     // emulate this by setting the error message as accessible description of the input field
     const auto description = errorShown ? ui.errorLabel.text() : QString{};
     if (ui.lineEdit.accessibleDescription() != description) {
         ui.lineEdit.setAccessibleDescription(description);
     }
 
     // Qt does not support IA2's "invalid entry" state (like WCAG's "aria-invalid" state attribute);
     // screen readers say something like "invalid data" if this state is set;
     // emulate this by adding "invalid data" to the accessible name of the input field
     const auto name = errorShown ? mAccessibleName + QLatin1String{", "} + invalidEntryText()
                                  : mAccessibleName;
     if (ui.lineEdit.accessibleName() != name) {
         ui.lineEdit.setAccessibleName(name);
     }
 }
 
 Key CertificateLineEdit::key() const
 {
     if (isEnabled()) {
         return d->mKey;
     } else {
         return Key();
     }
 }
 
 KeyGroup CertificateLineEdit::group() const
 {
     if (isEnabled()) {
         return d->mGroup;
     } else {
         return KeyGroup();
     }
 }
 
 QString CertificateLineEdit::Private::text() const
 {
     return ui.lineEdit.text().trimmed();
 }
 
 QString CertificateLineEdit::text() const
 {
     return d->text();
 }
 
 void CertificateLineEdit::Private::setKey(const Key &key)
 {
     mKey = key;
     mGroup = KeyGroup();
     qCDebug(KLEOPATRA_LOG) << "Setting Key. " << Formatting::summaryLine(key);
     // position cursor, so that that the start of the summary is visible
     setTextWithBlockedSignals(Formatting::summaryLine(key), CursorPositioning::MoveToStart);
     updateKey(CursorPositioning::MoveToStart);
 }
 
 void CertificateLineEdit::setKey(const Key &key)
 {
     d->setKey(key);
 }
 
 void CertificateLineEdit::Private::setGroup(const KeyGroup &group)
 {
     mGroup = group;
     mKey = Key();
     const QString summary = Formatting::summaryLine(group);
     qCDebug(KLEOPATRA_LOG) << "Setting KeyGroup. " << summary;
     // position cursor, so that that the start of the summary is visible
     setTextWithBlockedSignals(summary, CursorPositioning::MoveToStart);
     updateKey(CursorPositioning::MoveToStart);
 }
 
 void CertificateLineEdit::setGroup(const KeyGroup &group)
 {
     d->setGroup(group);
 }
 
 bool CertificateLineEdit::isEmpty() const
 {
     return d->mStatus == Private::Status::Empty;
 }
 
 bool CertificateLineEdit::isEditingInProgress() const
 {
     return d->mEditingInProgress;
 }
 
 bool CertificateLineEdit::hasAcceptableInput() const
 {
     return d->mStatus == Private::Status::Empty
         || d->mStatus == Private::Status::Success;
 }
 
 void CertificateLineEdit::Private::setKeyFilter(const std::shared_ptr<KeyFilter> &filter)
 {
     mFilter = filter;
     mFilterModel->setKeyFilter(filter);
     mCompleterFilterModel->setKeyFilter(mFilter);
     updateKey(CursorPositioning::Default);
 }
 
 void CertificateLineEdit::setKeyFilter(const std::shared_ptr<KeyFilter> &filter)
 {
     d->setKeyFilter(filter);
 }
 
 void CertificateLineEdit::setAccessibleNameOfLineEdit(const QString &name)
 {
     d->setAccessibleName(name);
 }
 
 #include "certificatelineedit.moc"