.gnupg directory and its contents should be owned by the user whose keys are stored therein and who will be using them. There is in principle no problem with a root-owned
.gnupg directory in your home directory, if root is the only user that you use GnuPG as (in that case one could argue that the directory should live in
/root or that you should do things differently).
I can see nothing wrong with the file permissions in the file listing that you have posted. The
.gnupg folder itself should additionally be inaccessible by anyone other than the owner and user of the keys.
The reason why the files may initially have been owned by root could be because GnuPG was initially run as root or by a process executing as root (maybe some package manager software or similar).
GnuPG does permission checks and will warn you if any of the files have unsafe permissions. These warnings may be turned off (don't do that):
Suppress the warning about unsafe file and home directory
--homedir) permissions. Note that the permission checks that
GnuPG performs are not intended to be authoritative, but rather
they simply warn about certain common permission problems. Do
not assume that the lack of a warning means that your system is
Note that the warning for unsafe
--homedir permissions cannot be
suppressed in the
gpg.conf file, as this would allow an attacker
to place an unsafe
gpg.conf file in place, and use this file to
suppress warnings about itself. The
warning may only be suppressed on the command line.
--homedir directory referred to above is the
.gnupg directory, usually at
$HOME/.gnupg unless changed by using
--homedir or setting
Additionally, the file storing the secret keys will be changed to read/write only by default by GnuPG, unless this behaviour is turned off (don't do that either):
Don't change the permissions of a secret keyring back to user
read/write only. Use this option only if you really know what
you are doing.
This applies to GnuPG 2.2.3, and the excerpts above are from the
gpg2 manual on an OpenBSD system.