Currently, Kmail while using libnss creates $HOME/.pki/nssdb directory. Libnss now supports XDG base directory spec. Clients which use it though need to explicitly enable that. See https://bugzilla.mozilla.org/show_bug.cgi?id=818686#c15 Please do it in Kmail to avoid cluttering $HOME.
Sorry it's not a kmail problem... We don't generate it. Perhaps gpgme...
I'll try to narrow it down to some dependency, but it's certainly being created when Kmail starts.
lsof also shows, that kmail holds these files in $HOME/.pki/nssdb open while running: cert9.db key4.db
For sure we don't create it in kmail. But perhaps in its dependancies.
I think I found the culprit: apt depends kmail | rg libqt5webengine Depends: libqt5webenginecore5 (>= 5.15.2~) apt depends libqt5webenginecore5 | rg libnss Depends: libnss3 (>= 2:3.22) I can look into Qt Web Engine and how it uses libnss and file a bug there.
Hmm, since Qt Web Engine seems to be using Chromium, this might be the upstream bug: https://bugs.chromium.org/p/chromium/issues/detail?id=1038587