git-gpg-wrapper is incompatible with git ≥ 2.21
Something like #20757 (moved), it seems they swapped the first two parameters in https://github.com/git/git/commit/58af57e1c886a7c9fed7fb35f2dd8dd14cc5e4e0. So for me git is calling with:
--keyid-format=long --status-fd=1 --verify /tmp/.git_vtag_tmp0WyCC4 -
This throws errors for expired signatures (cmake, tor, obfs4).