If a user's key has an expiry date set, he should be warned if it expires soon. The time limit should default to a reasonable period (e.g. 28 days) but should not be hardcoded but user-settable (in prefs.js).
Question is which keys should be checked: only those explicitely chosen for accounts or all secret keys? Since determining keys for all accounts may be difficult, I suggest to check all private keys once upon program start. For users like me who rarly close/restart Thunderbird, one might even discuss whether it is necessary to check once a day but I consider it sufficient to check on start of the warning period is long enough. Alternatively, one could do the check only for own keys used in operations. However, one would need to check then if GnuPG settings add another own key to encrypt to. Thus I think, cleanest would be to check all private keys upon start.
Important would be to be able to deactivate the reminder for single private keys. There are lots of people out there who share their private keys with other users and/or whos keys are administrated by someone else (for example remote). Seen, that they may not be authorised to create new keys for all of their accounts themselves, it would be annoying not being able to use the fuction at all in order to avoid the messages for the keys they cannot update.
Implemented on master.
The feature can be turned off by setting the preference "extensions.enigmail.warnKeyExpiryNumDays" to 0.