Sorry, this is not a helpdesk.
In my understanding, the builtin default values are nowadays sensible for general use.

Hmm, okay - I've just checked my little local CentOS server and indeed, it doesn't have a gpg.conf (or any conf) under ~/.gnupg. My apologies.

When you enter a new $HOME then maybe (unusually!) it came with furniture preinstalled but if it comes with personal items like toothpaste preinstalled, then you should not trust it.

No, that is not the issue here. The issue here is:

So, if PureOS insists on being unusual, the question becomes - why is PureOS unusual in this particular way?

The gnupg package in PureOS is the exact same as the gnupg package in Debian.
If the issue here is that you find the PureOS initial configuration of gnupg inferior to that of Debian, then you are mistaken.

Phew, this file exists on the gnupg implementation in Debian, CentOS and Fedora, at least - those are all fairly standard implementations of gnu/linux (although arguable implementations of two standards).

Correct, no gpg.conf file exist after a fresh install.

man gpg says:

Aug 12 19:25:07 sigyn kernel: PM: suspend entry (deep)
Aug 12 19:25:07 sigyn systemd-sleep[14674]: Suspending system...
Aug 12 19:25:07 sigyn systemd[1]: Starting Suspend...
Aug 12 19:25:07 sigyn systemd[1]: Reached target Sleep.
Aug 12 19:25:07 sigyn kernel: r8169 0000:02:00.0 enp2s0: Link is Down
Aug 12 19:25:07 sigyn NetworkManager[617]: <info> [1628810707.6702] device (enp2s0): state change: disconnected -> unmanaged (reason 'sleeping', sys-iface-state: 'managed')

For completeness, you're referring to https://pureos.net/ ?

Right, I clearly misunderstood what is the issue you are reporting here.
Can you please help clarify what is broken about gnupg.
If nothing is broken about gnupg then what else is the issue?
I mean, this is an issue tracker (not e.g. a helpdesk or a chat forum).

I'm not sure I understand the relevance of the answer to the question?
The question was: why are the defaults not reflected here:

~/.gnupg/gpg.conf (as per man gpg) as I would expect and are on my Debian 10 install
Or;
~/.gnupg/dirmngr.conf (as suggested here)

Those aren't 'system-wide' locations.

Correct, gnupg by design has built-in defaults and no system-wide configuration.
What is the issue you have with that?

What I'm wondering is: why isn't the necessary data automatically generated at package build time and included as a file (perhaps named PACKAGE.contents) in the .deb file? Then to build the Contents file for a repo would just involve scanning through all the .deb files and extracting the .contents file from each and then concatenating them. I don't understand the Debian package build system well enough to know why it doesn't work this way.

[Update: I now see that this is T155. Possibly this should be marked as a duplicate of that? I don't yet know how to do that.]

This issue should be solved by now.

maybe, thanks for the tip.

is it perhaps possible to use the binary /usr/lib/grub/i386-coreboot/cbmemc.mod already provided in package grub-coreboot-bin?

Debian requires freely licensed source.
An artifact of a build process is not source.
Some third-party simply redistributing the artifact does not make it source.
Some third-party forking the artifact as a new project may make it source (depending on whether it is treated as the preferred form for modification by that new upstream author).

@jonas.smedegaard is a package like the above: that is not a standalone project but an artifact generated in the build process of coreboot something that would normally be ok to package as a debian package.
Or is there any debian guideline against packaging something like this?
Considering that we do not package coreboot (the project that generates this binary in it's build process) as deb.

hm. This isue seems solved now.

Just stumbled upon yet another meta search engine which might (or might not - e.g. it doesn't seem decentralized) be relevant to consider: https://search.lilo.org/

This is not a Freedom issue: Promoting a commercial service does not violate the GNU Free Distribution Guidelines.
Instead, it is arguably a privacy issue - i.e. the code does not in itself leak personal data but promotes the use of a service which does.

This is a meta-issue tracking a bundle of issues, and as such not a Freedom issue (that is identified for each individual unbundled issue).

This is a meta-issue tracking a bundle of issues, and as such is not in itself a Freedom issue (that it identified for each unblundled issue). Lowering priority accordingly.

This is an issue in Debian but not in PureOS, because PureOS offers no nonfree packages.

This is an issue in Debian but not in PureOS, because PureOS offers no nonfree packages.

This issue is bogus for PureOS, because PureOS provide no non-free packages.

this is a meta-issue tracking multiple issues, and as such is not in itself a Freedom issue (that is identified for each individual unbundled issue).

This issue is not in itself a Freedom issue, but a bundling of multiple issues seemingly all tracked on their own.
Lowering priority and closing accordingly.

This issue is not in itself a Freedom issue, but a meta-issue bundling several issues tracked on their own.
Lowering priority accordingly

This issue is considered solved in PureOS.
It is true that the solution used for PureOS is not ideal, but it is effective: Users cannot accidentally or sloppily make use of the EME implementation included with Firefox ESR as shipped with PureOS, because it requires manually editing plaintext files to enable that functionality.