desktop: forget GPG and SSH credentials on screen lock.

[kousu]

Lock gpg-agent and ssh-agent when the screen locks.

Keys already time out after 45min addition to timing out keys (which I have set to 45m for both

arch-conf/kousu-desktop/src/etc/skel/.gnupg/gpg-agent.conf

Line 6 in 6f9d745

default-cache-ttl 2700

arch-conf/kousu-base/src/etc/ssh/ssh_config.d/site.conf

Line 11 in 6f9d745

AddKeysToAgent 45m

but on my phone my keys timeout when my screen locks, and that feels safer. I want to reproduce this on my laptop.

[kousu]

Some stumbling blocks:

• gnome-keyring-daemon never locks keys once you tell it to save their passphrases. A screen lock doesn't lock keys, restarting the agent doesn't lock keys. Which is like..what are you doing? They're unlocked at login (or if you've changed your password so it's different from the keychain password, at the first time something wants to access the keychain). I suppose this is because they want to make sure that e.g. sshfs or nextcloud sync keeps working in the background, but I would really like my ssh and gpg keys to not just be out in the open like that.
• you can work around this partly by systemctl --user mask gcr-ssh-agent.socket and then falling back on my pre-existing ssh-agent
• unclear to me if gnome-keyring-daemon does or doesn't implement the gpg protocol
• I could migrate fully to gpg-agent and disable gnome-keyring-daemon and ssh-agent, then 'clearing passwords' would just be the 'gpg-connect-agent reloadagent' command; requires some fiddling to make sure it uses the appropriate pinentry under all environments