Bug 506243

SUMMARY
KDE Neon installs with gpg-agent configured to also act as the ssh-agent.  This causes unexpected behaviors that can cause security concerns for users.  The gpg-agent will accept ssh keys like any ssh-agent, but it refuses to remove them when asked, even though it will claim it did.  

STEPS TO REPRODUCE
1. Create ssh key: "ssh-keygen" and accept the defaults
2. Add the key to the ssh-agent: "ssh-add ~/.ssh/id_ed25519"
3. Verify key was added: ssh-add -l
4. Remove the key from the ssh-agent (you will see it say "all identities removed"): ssh-add -D
5. Check again and see that the key was not in fact removed: ssh-add -l
6. Try to remove the key from the system completely: rm ~/.ssh/id_ed25519*
7.  Reboot
8.  Verify the key file is gone: ls ~/.ssh
9.  Verify the key is STILL in ssh-agent: ssh-add -l

OBSERVED RESULT
When ssh-add -D is run to remove all keys, the user is told that the keys were removed, but the ssh-keys were not removed.  

EXPECTED RESULT
When the ssh-agent says it has removed an ssh key, I expect that to be the truth.  

SOFTWARE/OS VERSIONS
Operating System: KDE neon User Edition
KDE Plasma Version: 6.4.1
KDE Frameworks Version: 6.15.0
Qt Version: 6.9.0
Kernel Version: 6.11.0-25-generic (64-bit)
Graphics Platform: Wayland
Processors: 12 × Intel® Core™ i7-10750H CPU @ 2.60GHz
Memory: 32 GiB of RAM (31.0 GiB usable)
Graphics Processor 1: Intel® UHD Graphics
Graphics Processor 2: NVIDIA GeForce GTX 1650 Ti

ADDITIONAL INFORMATION
This has been reported as a bug to the gpg-agent developers who have closed the bug, seemingly refusing to fix the issue ( https://dev.gnupg.org/T3284 ).  I think this makes gpg-agent an unacceptable substitute for ssh-agent.  Consider this use case that is broken by gpg-agent.  Lots of password managers (keepass/keepasxc for example) allow ssh keys to be stored in the password manager.  When the password database is unlocked, the keys are added to the ssh-agent, and then when the database is closed the keys are removed.  The gpg-agent acting as an ssh-agent breaks this by claiming that it has removed the keys when ask, even though it did not.  

I want to be clear, I am not saying that this is a security vulnerability.  It is just an unexpected behavior in a security-significant context.