gpg: default to --no-auto-key-retrieve.