It seems debsign (the tool that actually does the signing) just picks up the first key that is still valid (I also have a revoked key) and matches the used identity.
There are many ways to fix this, but the one that will work for most cases is to run this command:
echo 'DEBSIGN_KEYID=0x0123ABCD' >> ~/.devscripts
Of course, you should replace 0x0123ABCD with the keyid which you prefer.
This will create a ~/.devscripts file (if it didn't exist) which will contain the DEBSIGN_KEY variable with the desired value. This file will be sourced by debsign before doing its actual work, so it will do the right thing when ran.
There are also git-buildpackage specific fixes like defining builder in the [DEFAULT] section of ~/.gbp.conf and passing '-k0x0123ABCD' to debuild something like:
[DEFAULT]
builder = debuild -i -I -k1234ABCD
...
But that probably gets ugly if you use a custom builder.
P.S.: I have just deleted my old key 0xDD1F1F9F since I won't be using it anymore. I don't remember where I put the revocation certificate, but I'll revoke the key, once and if I find the revocation certificate. Otherwise, it will expire in July, next year.
From now on, I am going to use only the key 0xE3E083A1 to which I even added a photo and some newer identities and updated with a few signatures I got during DebConf 9.
