I'm not quite sure about which component in the chain (Thunderbird ->
Enigmail -> GPG) is the root cause of this, feel free to reassign as
appropriate of course. I'm also not sure of which update introduced this
bug, because I don't reboot or restart applications on my Sid box very
often. The latest Thunderbird update was done on 2018-03-27, but I
noticed this behavior since yesterday only.
Also, please note that I chose to set the severity to "important"
because the CPU consumption makes the PC fans quite noisy, to the point
that I cannot keep Thunderbird sitting on an unused workspace anymore.
Feel free to drop it if you think that's not justified.
The symptoms are as follows: Thunderbird randomly tries to import public
GPG keys (it's really random, it happens when I'm not even using
Thunderbird to read e-mails, it's just sitting on a different workspace)
and the CPU consumption becomes very high.
Looking for the culprit with top, I can see a GPG process using one
whole CPU core, spawned by Thunderbird, and with the following options:
/usr/bin/gpg --charset utf-8 --display-charset utf-8
--no-auto-check-trustdb --batch --no-tty --status-fd 2 --keyserver
hkps://hkps.pool.sks-keyservers.net:443 --recv-keys <some key ID>
Killing the process immediately spawns a new identical one; killing the
second one makes Thunderbird rest for some time, until the problem
occurs again with a new key ID (generally in a matter of minutes).
Trying to fetch the key manually by copying the GPG command line in a
terminal works perfectly, which makes me think that the problem comes
from Thunerbird (or Enigmail), not from GPG.
Note that the key IDs belong to people related to free software; I'm
subscribed to a lot mailing lists (mostly Debian ones), but through
Gmane (and consequently Thunderbird NNTP reader). Could it be that
Thunderbird silently reads new entries in those newsgroups and tries to
fetch the GPG keys ? This would be surprising, given that normally
Thunderbird doesn't update the newsgroups unless I specifically ask it
to (by clicking on a group, or selecting "Get new messages" on the news
account, in the left panel), but that's the only explanation I could
find for the source of the random GPG key IDs it tries to fetch.