# the "loopback" argument in instances where "--passphrase-fd" is
# used.
#
-# The gpg-2comp found in some comments comes from
+# Some of the older commented-out versions of the commands use gpg-2comp from:
# http://70t.de/download/gpg-2comp.tar.gz
#
# %p The empty string when no passphrase is needed,
# file's name.
#
# %a In "signing" contexts, this expands to the value of the
-# configuration variable $pgp_sign_as. You probably need to
+# configuration variable $pgp_sign_as, if set, otherwise
+# $pgp_default_key. You probably need to
# use this within a conditional % sequence.
#
# %r In many contexts, neomutt passes key IDs to pgp. %r expands to
# a list of key IDs.
+# Section A: Key Management
+
+# The default key for encryption (used by $pgp_self_encrypt and
+# $postpone_encrypt).
+#
+# It will also be used for signing unless $pgp_sign_as is set to a
+# key.
+#
+# Unless your key does not have encryption capability, uncomment this
+# line and replace the keyid with your own.
+#
+# set pgp_default_key="0x12345678"
+
+# If you have a separate signing key, or your key _only_ has signing
+# capability, uncomment this line and replace the keyid with your
+# signing keyid.
+#
+# set pgp_sign_as="0x87654321"
+
+
+# Section B: Commands
+
# Note that we explicitly set the comment armor header since GnuPG, when used
# in some localiaztion environments, generates 8bit data in that header, thereby
# breaking PGP/MIME.
set crypt_replysignencrypted = yes
set crypt_verify_sig = yes
+
# Section A: Key Management
-# The (default) keyfile for signing/decrypting. Uncomment the following
+# The default keyfile for encryption (used by $smime_self_encrypt and
+# $postpone_encrypt).
+#
+# It will also be used for decryption unless
+# $smime_decrypt_use_default_key is unset.
+#
+# It will additionally be used for signing unless $smime_sign_as is
+# set to a key.
+#
+# Unless your key does not have encryption capability, uncomment this
# line and replace the keyid with your own.
-set smime_default_key="12345678.0"
+#
+# set smime_default_key="12345678.0"
+
+# If you have a separate signing key, or your key _only_ has signing
+# capability, uncomment this line and replace the keyid with your
+# signing keyid.
+#
+# set smime_sign_as="87654321.0"
# Uncomment to make neomutt ask what key to use when trying to decrypt a message.
# It will use the default key above (if that was set) else.