Pass sender User ID directly to gpg instead of resolving it to fingerprint

[Wiktor]

Currently, when a key selection scheme "Use email address of this identity to identify OpenPGP key" (pgpKeyMode == 0) is used Enigmail internally resolves the e-mail to fingerprint and uses that as -u flag to GnuPG.

If the e-mail address would be passed directly to GnuPG as an -u option then gpg would insert the e-mail as a Signer's User ID packet. On the receiving end gpg would use Web Key Directory to download the key to verify the signature.

This behavior is implemented in enigmailMsgComposeOverlay.js in getSenderUserId. I found out that using -1 (minus one) as pgpKeyMode EnigMail would pass the e-mail and gpg would correctly insert it into the signature, but this is kind-of a hack (abusing if-structure of the function).

Example signature with Signer's UID packet:

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEWaKd6o03OIxlaGPfuXoe4J20F+wFAls59bAUHHdpa3RvckBt
ZXRhY29kZS5iaXoACgkQuXoe4J20F+wifg//R5c5GrOtpeud0sGEbo4CHSj+hU9F
npeRb4yn9wyAWGUeN8nIGeV0izMDE+oNWLgtGeBKbvCICTeslDH6tmsxPQ0cT8/u
ntPAvAg578KIIKe5AqIRMbGhoMhCwyiBEgjLSvs7mbdnGZ/AB9jti46/hJBUEY1G
MUk68n2S7NSjr8BxfVAYOu6yEkDjJEPDYsam9kkk5n+IjR6O2mg7vA1ZGXAPon98
Nw3+ggy0Nj/64MlXAbytNV9+IEvjGnZHZObgwqHnR2ROTLqzqJn4NUuknKiaN/nt
uZhzl3tzCXYlxb6e+InW3SKzPXHTQ6ucWh8mANmLR0IF2yOnrAY7VFD2TZaC+Km8
45YUkDeM7WPQ72wqPv+kiTwibcmkqljPRauGG803hL+ETNXX6xtqEyi1trKcIGKG
Te4x/aK9Kdq0kom4TZCjjNxZmfSu2hyRUFjsek/IYl88QL1g8n3V9skuxI602LaE
I3DVX7UonHRvCnZ3Fxq/so7mSH6yfa97LYMYrGRVtXzHfJqqiA0fb5OhoddGaZ3y
1YhQXBJyVJMNm9DGkd84fN5xof1GkykIvyRSaNF25ioLQKbHxb3/y2BVbkhWxidT
Et28WAE3gas4aqoTiMHE92rDCb7VlKhaDninkE+lTAmQjWbwoMxNssHfZYJH3XrR
nNUCMT5bwWQOfYA=
=VMcd
-----END PGP SIGNATURE-----

(this file can be passed to gpg --list-packets to see that there is a signer's user ID packet inserted).

[Patrick Brunschwig]

The reason for this is that -u "email@address" is frequently not unique: GnuPG would use the first key on your keyring that matches the email address to sign the message. But this is usually the oldest (and thus often the weakest) of all keys.
We think that this is not desired - we want to use the best suitable key for this purpose and therefore do no longer use -u "email" bug -u "FPR".
In addition, we support Autocrypt - the key is included in the header, and therefore a WKD lookup should be required at all.

[Wiktor]

Thanks for taking the time to explain Patrick! I see bad GPG defaults require more workarounds.

I think the logic for selecting "the best" key should ultimately be built-in GnuPG as more tools use it, e.g. git, but even if it was, you support multiple versions of GPG so it's not immidiately helpful...