gkr-pam won't change password if it was empty before
If both the user and the login keyring password is empty (like when you set an empty user password using passwd -d
and set gkr to not encrypt the users keyring) and the user sets their password, gkr-pam will fail to also set a keyring password, logging "gkr-pam: couldn't update the login keyring password: no old password was entered".
As gnome supports empty passwords for logging in without a password, when a user then sets a password, gnome-keyring should also start protecting the login keyring.
https://gitlab.gnome.org/GNOME/gnome-keyring/-/blob/master/pam/gkr-pam-module.c#L1000