Why does GPG ask for passhrase when ~/.gnupg/gpg-agent.conf exists?

Solution 1:

gpg-agent does not have any "persistent" password storage of its own. It always forgets passwords after a reboot and has to call pinentry for the first time.

However, all the standard graphical pinentries have their own integration with libsecret persistent password storage – which means they'll store the passphrase in GNOME Keyring. Whenever gpg-agent runs the full-screen "pinentry-gnome3" after reboot, the pinentry app just directly returns the passphrase from GNOME Keyring without needing to actually prompt for anything.

Meanwhile, the text-mode pinentry apps (pinentry-curses, pinentry-tty) do not have libsecret integration, as they're meant to be used in environments where something like GNOME Keyring wouldn't survive.

To have this again, you will need to switch to either pinentry-gtk-2 or pinentry-qt.

Side note: I suspect that GnuPG's choice to invoke the full-screen prompter provided by GNOME Shell was very deliberate, as even before GNOME 3, the simple gtk-2 pinentry already had an option to globally grab all input events regardless of focus; this was meant to prevent users accidentally typing their password into the wrong window. (I think this was just relatively recently changed to be off by default.)