Keybase reset leaves the private key in place.

When performing a keybase login on a user with a hosted private key that key is downloaded and registered to the user's gpg keyring.

I believe a keybase reset (which removes any established session, local cache and deregisters the user from the client) should also remove the private key from the gpg keyring (if it put it there).

If would be fair for any user of the keybase client to assume that a keybase logout and reset would destroy any residual information about their usage. However this isn't the case.

Leaving these keys in place would then allow anyone that gained / was granted access to the users machine (as that user thought all key information / sessions were destroyed) to then be able to create an encrypted message for another keybase user

gpg --import {keybase users public key}

echo "message" | gpg --output message.txt --encrypt -r {private key name} --recipient {user}@keybase.io

I understand a user that only uses a local private key (not uploaded to keybase) wouldn't want their private key removed from their keyring. So it could be left in tact in this instance.

Start by tracing the keybase reset and logout flows, then identify where hosted private keys are registered in the user's GPG keyring. Verify that keys placed there by Keybase are removed while locally managed keys remain, and confirm the behavior for both reset and logout.

Written by the indexing model from the issue text.