Updated to latest MacOS. Yay!
Repeated prompts to "unlock keychain". oh no!
I was determined to not reset my login keychain, because then you lose the TouchID gnubby and have to reimage the whole laptop. (May only apply to santa exceptions, maybe not..)
I finally got lucky and found a way to work around it. (and yes, I've let Techstop know about it)
1) Open Keychain app.
2) Click on login item in left pane.
3) Right click on login item, select 'Change settings for Keychain "login"'
4) In my case the Lock After setting was checked and had a large number
5) Change the timeout value and save.
You'll need to enter your keychain password a few times. But once you're done the keychain will possibly be updated and uncorrupted.
To verify you can run the gcert command in your terminal. You should not be prompted to unlock the keychain and touchid should be requested.
Theory: changing the expiration setting forces the keychain app to rewrite the keychain data structures fresh.