New indefinit passphrase cache + opt out not documented?

During today's update I was informed that from now on keybase desktop (win) will no longer ask for my PGP passphrase (or was it keybase.io password?).

It gave me an option (on the CLI) to opt out but transfer PGP operations back to GPG.

I can for the life of me not find those things in the documentation on the website. Neither the new security concept nor the opt-out commands.

Can you supply a link or update the documentation?

Does droping back to GPG mean just getting asked for the passphrase by gpg for every en/decryption or does it mean all en/decryption features will be disabled in keybase.io?
(The former should definitely be an option)

How is the cached passphrase stored in between client restarts?

Start by locating the Keybase website documentation covering the desktop client's PGP passphrase behavior and the CLI opt-out command. Verify what reverting to GPG changes and how the passphrase is stored across restarts. Done means adding documentation links and clearly answering the opt-out, fallback, and storage questions.

Written by the indexing model from the issue text.