unclear messaging around private key re-encryption on upload

My private key is regular-ascii-armor-encrypted with a lengthy passphrase.

I'd like keybase to store that encrypted key.

I clicked "edit" next to the fingerprint on my profile on the website, then clicked "host an encrypted copy of my private key".

I saw this modal dialog 

It sounds like exactly what I want: I have an encrypted copy of my private key, and I'd like to store it with keybase, and I wouldn't like keybase to know the passphrase, so I click "Let's do it".

now I see this modal dialog 

It seems a bit odd that keybase needs my passphrase at this time, but the previous modal said "Keybase servers never see your passphrase", and I trust that claim, so I enter my passphrases and click "Encrypt" then "Upload".

I test that it worked by signing something on the website. I enter the regular ascii-armor passphrase that my key is encrypted with, and it says I entered an incorrect passphrase:


I eventually think to try again with my keyase-site-login-passphrase, and the thing signs. I'm immediately surprised and concerned—this is not the behaviour I expected.

* * *

Now that I'm going back through this flow, the exhibited behaviour—decrypt my ascii-armor, and re-encrypt with my keybase passphrase—is consistent with the messaging.

The problem is, the behaviour I expected is _also_ consistent with the messaging.

If I come into the process with the expectation that I'm uploading a key that I've already encrypted, nothing screams "HEY! THAT ISN'T WHAT WILL HAPPEN!" Since private-key-upload is a particularly sensitive aspect of what keybase does, I think erring on the side of extra clarity would be wise.

On the other hand, I'm just one data point. Perhaps this is obvious to everyone but me.

Start with the website profile edit flow and the two modal messages described in the issue. Compare their wording with the observed re-encryption and signing behavior; done means the flow clearly tells users which passphrase is used and what happens to the uploaded key.

Written by the indexing model from the issue text.