I've found today, that enigmail is decrypting a message without asking me for the smart card's PIN. It is asking only once, and then not ask at all.
this is my gpg-agent.conf:
default-cache-ttl 0 max-cache-ttl 0 no-allow-external-cache ignore-cache-for-signing
card-timeout 0 deny-admin
gpg.conf is empty
gpg (GnuPG) 2.1.16
Gnome keyring is stopped. What am I missing here?