For (slightly) increased security, I would like to have better control of the lifetime of any unlocked keys, depending on the task being performed. Ideally, I would start an interactive sub-shell, do any tasks involving secrets, then have all unlocked keys be cleared automatically when the sub-shell exits.
I know that one can manually clear cached passphrases using gpg-connect-agent
, but AFAIK that requires each key to be specified explicitly. Another option would be to set a sort cache expiry time using the --default-cache-ttl
or --max-cache-ttl
options for gpg-agent
; but generally that means either setting a long TTL, or being asked for the same passphrase more than once.
I seem to remember that a long time ago it was possible to specify an alternative gpg-agent
socket path and basically start an independent session, but that does not seem to be possible any more; newer versions seem to use a fixed path that cannot change.
So, what am I missing? Is there a way to achieve what I want?