Only the login keyring is unlocked on login in GNOME by default. Creating another keyring allows to store secrets and manually control when to unlock them instead. A straightforward way to recreate that behaviour on Librem 5 may be to install GDM to use instead of Phog. But, the last time I checked, GDM was not as convenient as Phog on Librem 5 when using a login password comprising of numbers as the default Librem 5 setup suggests. I imagine that Phog could possibly use greetd if it were installed. But it happens to be not necessary. The following additions at the end of the PAM module configuration files seem to do the trick.
$ grep gnome /etc/pam.d/common-session
session optional pam_gnome_keyring.so auto_start
$ grep gnome /etc/pam.d/common-auth
auth optional pam_gnome_keyring.so
Now, the login keyring is unlocked automatically after login in into Librem 5. “Authenticator” application works after login without taking a step to manually unlock the keyring.
I vaguely remember that I needed to rename my default keyring to login in the past for it to be unlocked at login, so you may also need to do this if yours is not named login.
I could only find outdated documentation about specifying pam_gnome_keyring.so in PAM. Does anyone know where I could find newer documentation?