Since gnupg 2.1.10 the option --encrypt-to checks for for ambigious keys. But
this also fails, when there are two keys, where one key is valid and the other
one is expired and revoked.
This is a common case. When someone creates a new key, it is a good practise to
keep the old one to decrypt old data.
$ LC_ALL=C gpg --encrypt --encrypt-to mail@oshahn.de -r 0x5334752442830117 --armour
gpg: key specification 'mail@oshahn.de' is ambiguous
gpg: (check argument of option '--encrypt-to')
gpg: 'mail@oshahn.de' matches at least:
gpg: B953A7355F1149ABCA8F2B2AE4835646BDE8EA81
gpg: 6D3A9AB887A6229308D9C007E72581B1FE9F104C
See also:
https://admin.hostpoint.ch/pipermail/enigmail-users_enigmail.net/2015-December/003563.html