Error: There is no assurance this key belongs to the named user

Tue Apr 28 18:12:52 UTC 2026

On 21 Apr 2026, Jens Tröger wrote:
>Still haven’t found an explanation or solution, but after more
>searching I came across this thread on the gnupg-users mailing
>list.
>
>    https://marc.info/?m=157167920418502
>
>In contrast to that post, I do not have a duplicated
>.gnupg/trustdb.gpg* And when I export the ownertrust values:
>
>    gpg --export-ownertrust
>
>then the list contains *only* 1E1...EA7 of the public key but
>not 09D...798 of the subkey.
>
>Any help would be great!

I have encountered that error a lot.  Below is the documentation I 
wrote for myself on how to handle it; whether this will help you 
or not, I don't know, but I wish you luck.  (Note that we seem to 
have found exactly the same post from Matthias Apitz on 
'gnupg-users' :-) .)

---

  You may get an error like this:

    gpg: 8E8AF6393F237A2E: There is no assurance this key belongs 
    to the named user
    gpg: [stdin]: encryption failed: Unusable public key

  It's due to GPG trust/signature issues that are so intricate
  that I won't go into them here because I don't want to use up
  the remaining blank bits on my disk :-(.  The solution I used
  (in at least one case, anyway) was to add both a trust level
  and a signature to the relevant subkey (notice how in the error
  message above, the "8E8AF6393F237A2E" matches the subkey shown
  below, rather than matching the main public key).

  One solution is to do something like this:

    > $ gpg --edit-key 5972830CA206DCBA1EF97758D674C7632F4AC0E7
    > pub  rsa4096/2674C7632F4AC0E7
    >      created: 2022-11-21  expires: 2024-11-21  usage: SC  
    >      trust: full          validity: unknown
    > sub  rsa4096/8E8AF6393F237A2E
    >      created: 2022-11-21  expires: 2024-11-21  usage: E   
    > [ unknown] (1). J. Random <jrandom at example.com>
    > 
    > gpg> key 8E8AF6393F237A2E
    > 
    > [...]
    > 
    > gpg> trust  
    > Please decide how far you trust this user to correctly 
    > verify other users' keys
    > (by looking at passports, checking fingerprints from 
    > different sources, etc.)
    > 
    >   1 = I don't know or won't say
    >   2 = I do NOT trust
    >   3 = I trust marginally
    >   4 = I trust fully
    >   5 = I trust ultimately
    >   m = back to the main menu
    > 
    > Your decision? 4
    > 
    > [...]
    > 
    > gpg> sign
    > Your current signature on "J. Random <jrandom at example.com>"
    > is a local signature.
    > Do you want to promote it to a full exportable signature? 
    > (y/N) y
    > 
    > pub  rsa4096/2674C7632F4AC0E7
    >      created: 2022-11-21  expires: 2024-11-21  usage: SC  
    >      trust: full          validity: full
    >  Primary key fingerprint: 5972 830C A206 DCBA 1EF9  7758 
    >  D674 C763 2F4A C0E7
    > 
    >      J. Random <jrandom at example.com>
    > 
    > This key is due to expire on 2024-11-21.
    > Are you sure that you want to sign this key with your
    > key "Karl Fogel <kfogel at example.com>" (810A75CB5CDE3845)
    > 
    > Really sign? (y/N) y

  Note that I had first done 'lsign' instead of 'sign', and that
  worked fine insofar as it solved my problem, but it generated a
  local (non-exportable) signature.  Since I wanted to send the
  signed key to others, I did the dance again with 'sign' before
  exporting.

  See also this thread from Matthias Apitz on gnupg-users@:

  https://lists.gnupg.org/pipermail/gnupg-users/2019-October/thread.html#62955

Best regards,
-Karl

>> On Apr 16, 2026, at 18:50, Jens Tröger 
>> <jens.troeger at light-speed.de> wrote:
>> 
>> Hello,
>> 
>> I’ve been happily using `pass` for many years, and have been 
>> keeping up-to-date using MacPorts: 
>> https://ports.macports.org/port/pass/
>> 
>> A few weeks ago, however, when I wanted to edit an existing 
>> entry, I received the following error:
>> 
>>    jens at pooh ~ > pass edit Some/Entry
>>    gpg: WARNING: server 'gpg-agent' is older than us (2.5.17 < 
>>    2.5.18)
>>    gpg: 81............98: There is no assurance this key 
>>    belongs to the named user
>>    gpg: 
>>    /var/folders/2r/yyz1661s4j91vhdkzktg66z80000gn/T//pass.kF4Gb3qAp07WP/QHBHgP-Some-Entry: 
>>    encryption failed: Unusable public key
>>    GPG encryption failed. Would you like to try again? [y/N] n
>> 
>> In the past I could just ignore the first line WARNING and 
>> update at a later point; that had no impact on using the 
>> agent. But now, with this error, I’m able to `pass show` but 
>> both `pass generate` and `pass edit` stopped working.
>> 
>> When I list the keys associated with that “faulty” one:
>> 
>>    jens at pooh ~ > gpg -k 81............98
>>    pub   rsa4096 2017-04-18 [SC]
>>          1E1..................................EA7
>>    uid           [ unknown] Jens Tröger 
>>    <jens.troeger at light-speed.de>
>>    sub   rsa4096 2017-04-18 [E]
>>          09D..................................798
>> 
>> and when I manually use the subkey to encrypt something I get 
>> the same error:
>> 
>>    jens at pooh ~ > gpg --recipient 
>>    09D..................................798 --encrypt --armor
>>    gpg: 81............98: There is no assurance this key 
>>    belongs to the named user
>> 
>>    sub  rsa4096/81............98 2017-04-18 Jens Tröger 
>>    <jens.troeger at light-speed.de>
>>          1E1..................................EA7
>>          09D..................................798
>> 
>>    It is NOT certain that the key belongs to the person named
>>    in the user ID.  If you *really* know what you are doing,
>>    you may answer the next question with yes.
>> 
>>    Use this key anyway? (y/N) y
>>    Hello
>>    ^D
>> 
>> So this works, although I get that exact same warning.
>> 
>> Now the question I have is: how can I fix this? And what 
>> happened here, why did that subkey suddenly (?) stop working?
>> 
>> Any insight would be appreciated, thank you!
>> Jens
>> 